Justia California Supreme Court Opinion Summaries

An educational technology company was contracted by a county office of education to provide software and technology services to school districts, which involved collecting and storing various types of student data, including medical information. In 2022, the company experienced a data breach that resulted in unauthorized access to student medical records, including those of a minor plaintiff. The minor, through a guardian, filed a class action lawsuit alleging violations of both the Confidentiality of Medical Information Act (CMIA) and the Customer Records Act (CRA), claiming the company was negligent in protecting confidential medical information and failed to provide timely disclosure of the breach.The Superior Court of Ventura County granted the company’s demurrer and dismissed the case, concluding that the plaintiff failed to state a claim under either statute, as the company was not a covered entity under the CMIA or CRA and the plaintiff was not a “customer” under the CRA. The California Court of Appeal, Second Appellate District, Division Six, reversed, finding that the company fell within the scope of both statutes and that the plaintiff had alleged sufficient facts to support both claims. The appellate court also determined that the trial court erred by denying leave to amend the complaint.The Supreme Court of California reversed the appellate decision. The Court held that the plaintiff did not sufficiently allege the company was a “provider of health care” under the CMIA, nor that he was the company’s “customer” under the CRA, so no claim was stated under either statute. However, the Court clarified that under the CMIA, a breach of confidentiality occurs when medical information is exposed to a significant risk of unauthorized access or use, and actual viewing by an unauthorized party is not required. The judgment was reversed and remanded for further proceedings. View "J.M. v. Illuminate Education, Inc." on Justia Law