Your Medical Records Were Exposed. Do You Have to Prove You Were Harmed?
An October 9, 2026 federal appeals court ruling could reshape how patients pursue legal action when their confidential medical information is disclosed without permission, raising questions about whether a breach of privacy is itself a legally recognizable injury.
By JEANNIE KIM
Imagine this: you receive a letter from your health insurance company informing you that your medical records were accidentally shared with a stranger. Your name, the doctors you visited, and the treatments you received are now in someone else's possession. Yet, because you cannot demonstrate any financial losses or physical consequences, a court determines that you have not suffered a legally recognizable injury.
On October 9, 2026, the United States Court of Appeals for the Ninth Circuit addressed precisely this question in Black v. IEC Group, Inc. The court ruled that the unauthorized disclosure of confidential medical information can constitute an injury sufficient to bring a federal lawsuit, even without evidence of additional financial or physical harm.
The decision raises a larger legal question: when sensitive information is exposed, must patients demonstrate what happened afterward, or is the violation of their confidentiality enough?
When a Privacy Breach Becomes a Lawsuit
The dispute began in August 2023, when Miles and Melissa Black received notices from IEC Group, a health insurance administrator operating as AmeriBen, informing them that some of their personal medical information had been disclosed to unauthorized individuals.
According to court documents, an employee mistakenly emailed a spreadsheet containing sensitive information to one or more other insurance plan members. The potentially exposed information included patients' names, healthcare providers, dates of medical services, claim numbers, and amounts billed. The Blacks subsequently filed a class action lawsuit alleging that the company had violated its promises to maintain the confidentiality of their information.
A federal district court in Idaho ended up dismissing the case, concluding that the plaintiffs had not demonstrated the concrete injury required to establish standing in federal court. However, the Ninth Circuit disagreed. Rather than requiring evidence of additional financial damage, the appeals court determined that the unauthorized disclosure of information entrusted to a company under a promise of confidentiality could itself constitute a legally recognizable injury.
The Constitutional Question of Standing
At the center of the decision is Article III of the U.S. Constitution, which limits federal courts to deciding actual cases and controversies. Under this requirement, plaintiffs must establish standing: a legal basis for bringing their dispute before a federal court. One essential component is demonstrating an injury in fact that is concrete, particularized, and actual or imminent. Traditionally, financial losses and physical injuries provide straightforward examples. Privacy violations, however, present a more complicated question.
But what happens when the alleged injury cannot be measured in dollars?
In its ruling, the Ninth Circuit examined the historical legal principles of breach of confidence and breach of contract. Courts have long recognized that disclosing information obtained through a confidential relationship can constitute a legal wrong.
The judges reasoned that the plaintiffs' alleged injury closely resembled these historically recognized harms. Significantly, the court did not determine that IEC Group was ultimately liable for damages. It determined that the plaintiffs had sufficiently alleged an injury to proceed with their lawsuit. And this distinction matters: establishing the right to sue is not the same as winning the case.
Where HIPAA Comes Into Conversation
The ruling also draws attention to the Health Insurance Portability and Accountability Act of 1996, commonly known as HIPAA. HIPAA establishes federal protections for certain medical information maintained by healthcare providers, insurers, and other covered organizations. Its privacy and security requirements regulate how protected health information may be used, disclosed, and safeguarded. However, HIPAA generally does not allow individual patients to sue directly for violations of the statute. Instead, enforcement primarily occurs through federal regulators, including the Department of Health and the Human Services' Office for Civil Rights.
This creates an important distinction between a federal privacy regulation and a patient's ability to pursue compensation through the courts. In Black, the plaintiffs relied on state-law claims, including breach of contract and negligence, rather than a private lawsuit directly under HIPAA. Nevertheless, the Ninth Circuit referenced HIPAA to reinforce the importance Congress has placed on protecting medical information. The ruling therefore does not create a new private right to sue under HIPAA. Rather, it recognizes that certain disclosures of confidential medical information may provide sufficient grounds for federal court jurisdiction when supported by an appropriate legal claim.
Why Medical Information Is Different
Unlike an exposed password or credit card number, medical information cannot necessarily be replaced. A patient's history of psychiatric treatment, neurological conditions, or genetic testing may reveal deeply personal information that remains sensitive long after the original disclosure. Even seemingly routine insurance records can reveal intimate details, as knowing which specialists a patient visits, how frequently appointments occur, or what treatments are billed may allow others to infer medical conditions without ever seeing an explicit diagnosis.
This makes confidentiality particularly significant in healthcare, where patients routinely disclose information they would otherwise keep private. As insurance databases and digital healthcare services become increasingly interconnected, the legal consequences of unauthorized disclosure extend beyond traditional concerns about identity theft. The question is no longer solely whether exposed information leads to measurable financial damage, but also whether patients possess an enforceable interest in the confidentiality they were promised.
What Questions Remain?
Although the Ninth Circuit's decision allows the plaintiffs' case to proceed, its broader implications remain uncertain. Federal courts have taken differing approaches to determining when intangible privacy harms satisfy constitutional standing requirements. The Ninth Circuit's reasoning may influence future litigation, but it does not automatically resolve every medical data breach lawsuit. Patients must still establish the remaining legal requirements of their claims, and defendants may contest whether a disclosure actually violated a legally enforceable duty.
The decision also leaves questions about how courts should distinguish between different kinds of information, confidential relationships, and unauthorized disclosures. For healthcare institutions, the ruling underscores the potential legal significance of promises made to patients about confidentiality. For patients, it recognizes something less easily quantified: the loss of control over private medical information may be an injury even when its consequences cannot be expressed in financial terms.
As healthcare becomes increasingly dependent on the collection and exchange of personal data, the law must continue to confront a fundamental question: if privacy is a right worth protecting, should patients have to prove further harm before a court will recognize its violation?
Sources & Further Reading
Black v. IEC Group, Inc. No. 25-5952. United States Court of Appeals for the Ninth Circuit, October 9, 2026.
Brown, Christopher. “IEC Group Gets Spreadsheet Leak Lawsuit Revived on Appeal.” Bloomberg Law, October 9, 2026.
U.S. Department of Health and Human Services. “Standards for Privacy of Individually Identifiable Health Information.” Office of the Assistant Secretary for Planning and Evaluation.
U.S. Department of Health and Human Services. “Your Rights Under HIPAA.” HHS.gov.
United States Court of Appeals for the Ninth Circuit. “Opinions: Black v. IEC Group, Inc.” United States Courts, October 9, 2026.
Comments