Law Firms Mentioned:Stoel Rives, LLP | Walsh PLLC
Organizations Mentioned:IEC Group, Inc.
The unauthorized disclosure of sensitive health information was akin to a breach of confidence or contract that courts have traditionally recognized as providing a basis for a lawsuit
The United States Court of Appeals for the Ninth Circuit has rever
By Jeffrey H. Brochin, J.D
The unauthorized disclosure of sensitive health information was akin to a breach of confidence or contract that courts have traditionally recognized as providing a basis for a lawsuit
The United States Court of Appeals for the Ninth Circuit has reversed and remanded the decision of the district court that dismissed a lawsuit after the lower court found that the unauthorized disclosure of private health information (PHI) did not constitute an injury-in-fact sufficient to confer Article III standing. In reversing the district court’s ruling, the appeals court referenced 400-year-old English law as well as contemporary American jurisprudence for the proposition that there existed a “close historical or common-law analogue” for the patients’ asserted injury, focusing on breach of confidence as a recognized harm (Black v. IEC Group, Inc., No. 25-5952 (9th Cir. Oct. 9, 2026)).
PHI disclosure. In August 2023, the patients were each sent a letter by their health insurance plan’s administrator, IEC Group, Inc. informing them that some of their PHI had been disclosed. An associate had emailed a spreadsheet containing their sensitive health information to “one or more [plan] members” and the information that “may have been disclosed” included (1) first and last names, (2) unique tracking numbers, (3) provider names, (4) claim numbers, (5) dates of service, and (6) the amounts billed or paid.
The patients brought a class action against the plan administrator in the U.S. District Court for the District of Idaho asserting several state-law claims, including that they entrusted their sensitive health information to IEC as a condition of their plan administration, and that IEC expressly and impliedly promised—including through its Privacy Policy—to keep that information confidential and not disclose it to any third party without their consent, and to use reasonable methods to prevent such disclosure. The patients further alleged that they provided their information in reliance on that promise and on a reasonable expectation of confidentiality.
District court dismissal. The district court dismissed the case after determining that the patients lacked Article III standing due to a lack of injury-in-fact. Specifically, the district court rejected the patients’ arguments that unauthorized disclosure of private information alone or the loss of the benefit of their bargain could satisfy the injury-in-fact requirement for standing. Instead, it interpreted Ninth Circuit caselaw as “support[ing] a narrower rule”, i.e., that to allege a concrete injury from disclosure of personal information, the patients were required to show the nature of the information disclosed, the context of the disclosure, and other alleged injuries associated with the disclosure that demonstrate an imminent and substantial injury (see Health insurance administrator prevails over its accidental data breach victims, Aug. 26, 2025). The patients then took the instant appeal.
History as the guide. The appeals court began its review by stating that “history remains our guide” in determining whether the patients had standing: “Because the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice, it is instructive to consider whether an alleged…harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Although an “exact duplicate” historically recognized harm was not required, intangible harms, if “traditionally recognized” by courts as providing a basis for a lawsuit, can satisfy the injury-in-fact requirement. The appeals court then proceeded to reference English cases going all the way back to 1644 for the “ancient rule” of equity denoting “breach of confidence” as one of three express bases for invoking a court’s jurisdiction.
Breach of confidence. In further analyzing the patients’ breach of confidence claims, the appeals court noted that later cases also confirmed that breach of confidence was actionable apart from any property or copyright interest, observing that: “a trust betrayed isthe harm,” and that beyond concerns of property or due process, the “hostility” made upon the relationship itself, the abuse of the “trust reposed” in another person, is itself the harm. In addition, around our Constitution’s framing, breach of confidence provided a basis for a suit in English or American courts, and that was deemed enough for the appeals court to conclude that breach of confidence serves as a “close historical or common-law analogue” for the patients’ asserted injury to allege standing under Article III.
Bolstered by Congressional action. In addition to the foregoing common law bases for upholding breach of confidence as a recognized harm, the appeals court further noted that “Congressional judgment” further confirms that the disclosure of such information is a concrete injury. Congress passed the Health Insurance Portability and Accountability Act (HIPAA) and subsequent amendments to protect certain sensitive health information from disclosure, and although HIPAA does not provide a private cause of action, it does prohibit disclosure, and even provides for criminal liability for, under certain conditions, “knowingly disclosing individually identifiable health information to another person.”
Based on the foregoing, the appeals court concluded that the patients’ allegation that IEC disclosed sensitive health information that they entrusted to IEC to keep private, was akin to a breach of confidence or contract that English and American courts have traditionally recognized as providing a basis for a lawsuit. They therefore reversed the district court’s judgment and remanded the matter for further proceedings.
The case is No. 25-5952
Judge: Tung, E
Attorneys: Bonner C. Walsh (Walsh PLLC) for Melissa Black. Bradley R. Prowant (Stoel Rives, LLP) for IEC Group, Inc
Companies: IEC Group, Inc
MainStory: TopStory CaseDecisions EHRNews GCNNews GeneralNews AlaskaNews ArizonaNews CaliforniaNews HawaiiNews IdahoNews MontanaNews NevadaNews OregonNews WashingtonNews
