Reported / Citable
Background
Plaintiffs Melissa and Miles Black receive health insurance from a plan administered by IEC Group, Inc. (doing business as AmeriBen). In August 2023, IEC sent each plaintiff a letter informing them that an associate had emailed a spreadsheet containing their sensitive health information—including names, unique tracking numbers, provider names, claim numbers, dates of service, and amounts billed or paid—to one or more unauthorized plan members. Plaintiffs filed a class action in the District of Idaho asserting eight state-law claims, including negligence, breach of contract, breach of fiduciary duty, and unjust enrichment. They alleged they entrusted their health information to IEC in reliance on express and implied promises of confidentiality, including through IEC’s Privacy Policy, and that IEC’s unauthorized disclosure deprived them of the benefit of their bargain. The district court granted IEC’s Rule 12(b)(1) motion to dismiss for lack of subject matter jurisdiction, concluding Plaintiffs lacked Article III standing because they failed to allege a concrete injury in fact. The court interpreted Ninth Circuit precedent as requiring a showing of ‘imminent and substantial injury’ based on the nature of the information, context of disclosure, and other associated injuries.
The panel reversed the Rule 12(b)(1) dismissal and remanded for further proceedings; it decided standing, not the ultimate merits of the privacy claims.
The Court’s Holding
The Ninth Circuit reversed the district court’s dismissal and remanded for further proceedings. The panel held that Plaintiffs adequately alleged an injury in fact sufficient for Article III standing. The unauthorized disclosure of sensitive health information entrusted to a defendant with a promise of confidentiality constitutes a harm historically recognized as a breach of confidence or contract, providing a basis for a lawsuit in English and American courts since the Founding era. The court traced the ‘ancient rule’ of breach of confidence through English equity cases (Duke of Queensberry v. Shebbeare, Yovatt v. Winyard, Abernethy v. Hutchinson, Prince Albert v. Strange, Morison v. Moat), Joseph Story’s treatises, and early American decisions (E.I. Du Pont de Nemours Powder Co. v. Masland, Corliss v. E.W. Walker Co., Stevens & Co. v. Stiles, Pavesich v. New England Life Ins. Co.). The court emphasized that the harm lies in the betrayal of trust and abuse of confidential relations, not merely in subsequent tangible damages. Congressional judgment via HIPAA, which criminalizes knowing disclosure of individually identifiable health information, further confirms the concreteness of this injury. Because every claim rests on the same core injury—unauthorized disclosure of confidential health data—the standing inquiry yields a single answer in Plaintiffs’ favor at the pleading stage.
The decision turns on the specific record and procedural setting described above. Its operative effect is limited to the relief stated in the disposition; issues the court did not reach remain open on remand or before the assigned district judge, as applicable.
Key Takeaways
- Unauthorized disclosure of sensitive health information entrusted to a plan administrator under a promise of confidentiality constitutes an ‘injury in fact’ for Article III standing, even absent allegations of identity theft, financial loss, or future misuse.
- The injury is analogous to the common-law action for ‘breach of confidence,’ which has been recognized in English and American courts since the 18th century as a basis for equitable relief and damages, independent of property rights.
- A breach of contract claim grounded in promises to keep health information private independently supports standing, as nominal damages for breach of contract have long been recognized at common law without proof of pecuniary harm.
- Congressional enactment of HIPAA, which protects the specific categories of data disclosed here (names, providers, dates of service, amounts billed) and imposes criminal penalties for unauthorized disclosure, reinforces that this harm is concrete and cognizable.
- The district court erred by applying a heightened ‘imminent and substantial injury’ standard; at the motion-to-dismiss stage, plaintiffs need only plausibly allege facts that, if proven, would establish standing.
Why It Matters
This decision establishes a clear precedent in the Ninth Circuit that a plaintiff has Article III standing to sue for unauthorized disclosure of confidential health information based solely on the breach of confidence and contract, without needing to demonstrate a risk of future identity theft or tangible financial harm. By rooting the injury in the historical common-law action for breach of confidence—distinct from the modern privacy tort—the court provides a robust historical analogue that satisfies the Supreme Court’s TransUnion framework. The ruling aligns with the Third Circuit’s concurring view in Barclift and distinguishes contrary dicta from the Seventh and Fourth Circuits regarding nominal damages in breach-of-contract cases. It also underscores that HIPAA’s statutory protection of health data, while not creating a private right of action, serves as congressional confirmation of the sensitivity and legal cognizability of such information. The decision revives a ‘nearly eclipsed’ common-law doctrine to address modern data-breach standing questions, potentially broadening access to federal courts for plaintiffs in similar health-data breach cases.
For California practitioners, the practical lesson is to match the requested remedy to the governing procedural vehicle and to preserve a record addressing the court’s stated legal test. The ruling should not be read more broadly than its posture permits.