Daily Blast October 15, 2013

Today, the California Court of Appeal, Second Appellate District, Division Seven (Los Angeles) issued an opinion in Regents of the University of California v. Superior Court of Los Angeles (Oct. 15, 2013, B249148) ___ Cal.App.4th ___, analyzing whether the Confidentiality of Medical Information Act (CMIA) authorizes “a private cause of action for damages based solely on the negligent maintenance or storage of medical information even if the patient’s confidential records were never viewed or otherwise accessed by an unauthorized individual.” (Slip opn., p. 3.) The court held that “section 56.101 allows a private right of action for negligent maintenance only when such negligence results in unauthorized or wrongful access to the information.” (Ibid.)

Plaintiff, a patient at the health care facility, sought damages from defendant health care facility for unlawful disclosure of confidential medical information in violation of the CMIA. (Slip opn., p. 4.) An encrypted external hard drive containing personal identifiable medical information had been stolen from the health care facility during a robbery. (Id. at pp. 3-4.) Defendant demurred contending that plaintiff “failed to state facts sufficient to constitute a cause of action for statutory damages under CMIA because that remedy was available only if a health care provider had negligently ‘disclosed’ or ‘released’ confidential medical information . . . .”  (Id. at p. 5.)  The trial court overruled the demurrer determining that “CMIA established two separate types of wrongful conduct—wrongful disclosure of confidential medical information under section 56.10 and wrongful maintenance and storage of confidential information under section 56.101.” (Id. at p. 6.) According to the trial court, “there is no requirement under section 56.101 that, to be eligible for the $1,000 nominal damages . . . that there also have been a negligent release of confidential information under section 56.36(b).” (Ibid.) Defendant petitioned for a writ of mandate. (Id. at p. 7.) 

The Court of Appeal granted the writ petition. The court concluded that “56.36, subdivision (b), incorporated into section 56.101, subdivision (a), requires pleading and proof that confidential information has been released in violation of CMIA to bring a private cause of action for nominal and/or actual damages.” (Slip opn., p. 15.) The appellate court explained that “the Legislature plainly intended an action predicated on a health care provider’s negligent maintenance of confidential information in violation of section 56.101 also plead and prove a release of that information.” (Id. at p. 12.)  However, the court explained that sections 56.101 and 56.36 do not require pleading and proving an affirmative communicative act by the health care provider as an essential element of the claim. (Id. at pp. 15-16.) Thus, “a health care provider who has negligently maintained confidential medical information and thereby allowed it to be accessed by an unauthorized third person—that is, permitted it to escape or spread from its normal place of storage—may have negligently released the information within the meaning of CMIA.” (Id. at p. 17.)                 lbbschi2

Related Practices

• Appellate