Background
Miles and Melissa Black received health insurance through a plan administered by IEC Group, doing business as AmeriBen. In August 2023, AmeriBen notified each plaintiff that an associate had emailed a spreadsheet containing their sensitive health information to one or more plan members without authorization.
The information that may have been disclosed included names, tracking and claim numbers, providers, service dates, and billed or paid amounts. The Blacks brought a putative class action asserting state-law claims including negligence, breach of contract, breach of fiduciary duty, unjust enrichment, and a Florida consumer-protection claim. They alleged that AmeriBen promised to protect the confidentiality of their information and breached those promises.
The District of Idaho dismissed the action under Rule 12(b)(1), holding that the plaintiffs had not alleged an injury in fact sufficient for Article III standing. The plaintiffs appealed.
The Court’s Holding
The Ninth Circuit reversed and remanded. It held that the alleged unauthorized disclosure of sensitive health information entrusted to AmeriBen was a concrete injury sufficient to establish Article III standing at the pleading stage.
The court concluded that the alleged harm closely resembled the historically recognized injuries of breach of confidence and breach of contract. Plaintiffs alleged that AmeriBen received their health information in a confidential relationship, promised to keep it private, and disclosed it without consent. That alleged betrayal of confidence itself supported standing, even without a claimed monetary loss or a substantial likelihood of future injury.
Congress’s protections for individually identifiable health information in HIPAA further reinforced that the alleged disclosure was concrete, the court said. The panel did not decide the merits of the plaintiffs’ state-law claims.
Key Takeaways
- An unauthorized disclosure of health information can itself constitute a concrete Article III injury when it breaches a confidential relationship.
- A plaintiff need not allege monetary harm or a likely future misuse of the information to establish standing on these allegations.
- The decision rests on historical analogues to breach of confidence and contract, not on a general ruling that every disclosure of private information establishes standing.
Why It Matters
The decision gives plaintiffs in the Ninth Circuit a path to federal court for claims arising from unauthorized disclosures of sensitive health data, where they plausibly allege that the recipient of the information promised to preserve confidentiality. It also distinguishes standing based on a completed breach of trust from standing theories based solely on risk of future harm.