The Ninth Circuit recently held that the unauthorized disclosure of sensitive health information was sufficient to establish Article III standing, even without allegations of identity theft, financial loss, or other downstream harm. In Black v. IEC Group, Inc., the court found that the inadvertent disclosure of sensitive health information was analogous to historically recognized “concrete” injuries like breaches of confidence and contract. While the decision may make it easier for some plaintiffs to make a threshold of standing, its reasoning leaves room for defendants to distinguish other security incidents.
Background and the Ninth Circuit’s Decision
Black arose after an employee of AmeriBen, a health plan administrator, inadvertently emailed a spreadsheet containing health information to other plan members. The information included names, provider information, claim numbers, dates of service, and amounts billed or paid.
The plaintiffs filed a putative class action alleging negligence, breach of contract, and other state-law claims. They alleged that AmeriBen had promised to protect their information, including through its privacy policy. The district court dismissed the case for lack of Article III standing, finding that the plaintiffs had not alleged a concrete injury or a substantial likelihood of future harm.
The Ninth Circuit reversed. Applying the Supreme Court’s framework in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the court considered whether the alleged injury was sufficiently similar to a harm traditionally recognized by courts. It concluded that the disclosure resembled a breach of confidence because AmeriBen disclosed information obtained through a confidential relationship without authorization. The court also pointed to AmeriBen’s alleged promises to protect the information, reasoning that the historical recognition of breach of contract claims further supported standing even without financial or physical harm.
The court also considered Congress’s judgment in enacting the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA does not create a private right of action, but it restricts disclosures of protected health information and imposes criminal penalties for certain knowing disclosures. 42 U.S.C. § 1320d-6(a)(3). For the court, those protections reinforced the conclusion that the unauthorized disclosure of health information can constitute a concrete injury.
Limits of the Ninth Circuit’s Holding
Several aspects of the decision may limit its application to other security incidents.
The court emphasized the sensitivity of the medical and insurance information involved, relying in part on Congress’s recognition of those privacy interests through HIPAA. The plaintiffs also alleged that AmeriBen expressly and implicitly promised to protect their information, including through its privacy policy. Both considerations informed the court’s conclusion that the disclosure resembled a traditional breach of confidence or contract. Whether the same reasoning would apply to other personal information or in the absence of a comparable relationship of confidence or contractual commitment remains an open question.
The case also involved a spreadsheet inadvertently sent to unauthorized plan members and allegations that the plaintiffs’ information was disclosed as a result. Notably, the court did not decide whether unauthorized access, without evidence that information was viewed, acquired, or disclosed, would support the same conclusion. This distinction may be particularly relevant where forensic investigations establish that a threat actor accessed an environment but cannot determine whether particular personal information was obtained.
The court left several legal questions unresolved. It declined to decide whether the traditional tort of public disclosure of private facts would independently support standing, noting disagreements among federal appellate courts over that tort’s publicity requirement. The court also acknowledged that other circuits have questioned aspects of the breach-of-confidence and contract analogues on which it relied. These disagreements may be especially relevant to defendants litigating outside the Ninth Circuit or those facing facts different from the unique nature of the disclosures involved in Black.
Finally, the decision addresses standing, not liability. The Ninth Circuit did not determine whether AmeriBen breached a legal duty or enforceable contract, or whether the plaintiffs could establish recoverable damages. Those questions remain subject to the requirements of the underlying claims.
Implications for Data Breach Litigation
Black may make standing-based dismissals more difficult where sensitive information was disclosed in violation of confidentiality commitments. However, the decision does not establish that every unauthorized disclosure of personal information constitutes a concrete injury.
For companies defending litigation following a security incident, forensic findings concerning whether particular information was accessed, acquired, or disclosed remain important. Where an investigation establishes unauthorized access to an environment but cannot confirm that the plaintiffs’ information was obtained, defendants may have grounds to distinguish Black depending on the allegations.
Privacy policies and other confidentiality commitments may also play a greater role in standing disputes. Where plaintiffs rely on those commitments to establish an injury, their specific language and the nature of the parties’ relationship may be important to determining whether Black applies.
Even where plaintiffs can establish standing, defendants may still have grounds to seek dismissal based on the absence of an actionable duty, breach, causation, or recoverable damages. Black may limit one avenue for early dismissal in certain data breach cases, but it does not resolve whether the underlying claims can succeed.