Ninth Circuit Finds standing for health data disclosures without proof of harm

A Ninth Circuit panel ruled on Oct. 9, 2026 that people enrolled in health plans can sue over the unauthorized disclosure of confidential health information, without having to show financial loss or likely future harm.

The case is Black v. IEC Group, Inc., No. 25-5952. Melissa and Miles Black received health coverage through a plan administered by IEC Group, Inc., doing business as AmeriBen. The Ninth Circuit reversed and remanded to the U.S. District Court for the District of Idaho for further proceedings.

In August 2023, AmeriBen notified the Blacks that an associate emailed a spreadsheet containing their sensitive health information to one or more plan members. It might have shown amounts billed or paid, dates of service, claim numbers, provider names, unique tracking numbers, first and last names. The opinion does not state how many recipients received the emailed spreadsheet. The panel did not treat the recipient count as material to standing.

The Blacks filed a putative class action in case number 1:23-cv-00384-AKB before Judge Amanda K. Brailsford. Their complaint asserted eight state-law claims, including negligence, breach of contract, breach of fiduciary duty, and a claim under Florida‘s Deceptive and Unfair Trade Practices Act.

The district court granted AmeriBen’s Rule 12(b)(1) motion to dismiss for lack of subject-matter jurisdiction because the plaintiffs did not show a substantial likelihood of future injury. The district court relied on Greenstein v. Noblr Reciprocal Exchange, an unpublished Ninth Circuit disposition filed August 21, 2024. That disposition is not precedent except as provided by Ninth Circuit Rule 36-3.

The decision departs from the risk-based method that many courts have applied since the Supreme Court’s 2021 ruling in TransUnion LLC v. Ramirez. To meet the historical analog test, the Ninth Circuit pointed to the long-established breach-of-confidence action, in which the injury is the broken trust itself rather than monetary loss.

The judges leaned on AmeriBen’s confidentiality promises and on HIPAA as proof that Congress views this data as worthy of protection, even though the statute gives individuals no private right to sue. Because every claim rested on the same disclosure, the court addressed standing for all claims together instead of considering them one by one.

The panel said it did not need to decide whether disclosure of private information alone, without a confidential relationship, would confer standing. The ruling decides jurisdiction at the pleading stage only. The plaintiffs have not won on the merits and must still prove their claims.

Circuit Judges Michael Daly Hawkins, William A. Fletcher, and Eric C. Tung formed the panel. Judge Tung wrote the opinion without a concurrence or dissent. Tung wrote, “a trust betrayed is the harm.” The National Law Review quotes him as writing, “We hold yes.”

The ruling binds federal courts in the Ninth Circuit, covering Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, Washington, and Guam. The Northern Mariana Islands are included in the Ninth Circuit under a separate statute.

HIPAA prohibits unauthorized disclosure of individually identifiable health information and can bring criminal penalties, but individuals cannot sue under HIPAA. The Department of Health and Human Services Office for Civil Rights enforces HIPAA. Under 45 C.F.R. section 160.306, a HIPAA complaint must be in writing. A complainant generally files it within 180 days after the complainant learned or should have learned of the act.

The Ninth Circuit said its position conflicts with the Third, Fourth, and Seventh Circuits on breach-of-confidence standing and nominal-damages contract claims. The court described those outside decisions as readily distinguishable while rejecting their reasoning.

Footnote 3 said the Third Circuit hesitated to treat breach of confidence as traditionally actionable, citing Barclift v. Keystone Credit Services. Footnote 3 also said the Seventh and Fourth Circuits questioned standing for nominal-damages contract claims, citing Dinerstein v. Google and Freeman v. Progressive Direct Insurance Co.

A division among circuits exists over whether a plaintiff alleging disclosure of private information must claim the publicity element, footnote 2 noted. One side in that divide includes the Eleventh, Tenth, Seventh, Third, and Fourth Circuits. The other side includes the D.C., Second, and Sixth Circuits.

The logic in the opinion may extend beyond data breaches to situations where a business shares information it vowed to keep confidential, including through website tracking tools or data-sharing arrangements.

Jones Day describes the court’s reliance on contractual promises as a separate basis for standing in the October 9, 2026 ruling. Jones Day says businesses should review privacy policies and data-sharing practices because of the decision. The opinion pointed to AmeriBen’s confidentiality promise in its privacy policy and said breach-of-contract claims can proceed without financial loss.

McDonald Hopkins reports that data breach class-action filings rose from about 100 in 2018 to more than 1,800 in 2025. The firm also says the ten largest data breach settlements reached more than $515 million in 2025.

Federal Rule of Appellate Procedure 40(d)(1) gives 14 days after judgment to file a petition for rehearing or en banc review. Counted from the October 9, 2026 filing, that window runs to roughly October 23, 2026.