Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case

According to InsuranceNewsNet, the case centers on a December 2022 email from an AmeriBen associate that contained a spreadsheet with plan members' health claims information.[2] The outlet reports that the information included names, unique tracking numbers, health care provider names, claim numbers, dates of service and amounts billed or paid.[2]Jones Day says the district court dismissed the case because the plaintiffs could not show a substantial likelihood of future harm, such as identity theft.[1]According to Jones Day, the appeals court relied on the centuries-old action for breach of confidence, explaining that "a trust betrayed is the harm."[1] The firm adds that the court also cited HIPAA as evidence that Congress views such information as worth protecting, even though the statute does not allow private suits.[1]McDonald Hopkins reports that Judge Eric Tung[3] wrote for a unanimous panel. The firm notes that the court left open whether disclosure alone, without a confidential relationship, would be enough.[3]Jones Day writes that plaintiffs could use the same argument whenever a company shares information it promised to keep confidential, whether by accident or by design, such as through website tracking tools[1]. Glaser Weil warns that a single misdirected email or spreadsheet can support a federal class action in the Ninth Circuit[4].Marc Dann of DannLaw, which represents the plaintiffs, told DannLaw's website that the decision means "the proverbial door to the courthouse will be opened to millions of people"[5]. InsuranceNewsNet reports that the Ninth Circuit's decision sends the case back to the district court for further proceedings.[2]