Ninth Circuit: Breach of Confidence Confers Standing in Health Data Security Case
Departing from the risk-based approach many courts have applied since TransUnion, and in tension with other circuits, the Ninth Circuit held that health plan participants whose confidential health information was disclosed without authorization suffered a concrete injury, even absent financial loss or a risk of future harm.
Background
On October 9, 2026, the Ninth Circuit revived a putative class action in Black v. IEC Group, Inc., holding that health plan participants whose confidential information was disclosed without authorization have standing to sue in federal court. An employee of the plan's administrator had mistakenly emailed a spreadsheet of participants' claims information to other plan members. The spreadsheet listed participants' names, provider names, claim numbers, dates of service, and amounts billed or paid. The district court dismissed the case because the plaintiffs could not show a substantial likelihood of future harm, such as identity theft.
The Court's Analysis
The Ninth Circuit took a different view. Under TransUnion LLC v. Ramirez, an intangible harm supports standing if it closely resembles a harm courts have traditionally recognized. The court found that analogue in the centuries-old action for breach of confidence, explaining that "a trust betrayed is the harm." It emphasized the administrator's promises, including in its privacy policy, to keep the information confidential and noted that breach of contract claims have long been actionable without financial loss. The court also cited HIPAA as evidence that Congress views such information as worth protecting, even though the statute does not allow private suits. Because every claim rested on the same disclosure, the court resolved standing for all of them at once.
Significance
Although Black arose from a misdirected email, its reasoning could reach beyond data incidents. Because the injury is the disclosure itself, plaintiffs may invoke the same theory whenever a company shares information it promised to keep confidential, whether by accident or by design, such as through website tracking tools or data-sharing arrangements. The court's view that a breach of contract is a harm even without actual damages could extend further, and the court left open whether disclosure of private information alone suffices. Companies' privacy commitments are thus central to the standing analysis. Still, the decision rests on a confidential relationship, contractual promises, and HIPAA-protected data, so defendants may be able to distinguish cases lacking those features. Companies should review their privacy policies and data-sharing practices with this decision in mind.
