Ninth Circuit Finds Standing to Sue Over Health Data Disclosure

Ninth Circuit Finds Standing to Sue Over Health Data Disclosure

On October 9, 2026 the U.S. Court of Appeals for the Ninth Circuit held that health plan members who allege their claims administrator disclosed confidential medical billing data they had entrusted to it have Article III standing at the pleading stage, without showing that identity theft is likely. The panel decided nothing on the merits.

Information last verified on October 10, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers Article III standing in federal court in the Ninth Circuit. Section 41 of title 28 lists Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, Washington and Guam; the Northern Mariana Islands sit in the same circuit under a separate statute, Pub. L. 95-157 and 48 U.S.C. section 1694(a). It does not cover whether any of the Blacks' state-law claims are valid, what damages anyone might recover, or standing rules in state court.

What Happened

Melissa and Miles Black get health coverage through a plan administered by IEC Group, Inc., which does business as AmeriBen. In August 2023 the company sent each of them a letter saying some of their information had been disclosed to unauthorized parties.

The letter said an associate had emailed a spreadsheet containing their sensitive health information to "one or more [plan] members." According to the opinion, the information that "may have been disclosed" included first and last names, unique tracking numbers, provider names, claim numbers, dates of service, and the amounts billed or paid. The opinion does not say how many people received the spreadsheet, and the plaintiffs allege that the scope and root cause of the incident are within AmeriBen's exclusive control.

The Blacks filed a putative class action in the U.S. District Court for the District of Idaho, No. 1:23-cv-00384-AKB, before Judge Amanda K. Brailsford. Footnote 1 of the appellate opinion lists eight state-law counts: negligence, negligence per se, breach of contract, breach of implied contract, breach of fiduciary duty, unjust enrichment, declaratory and injunctive relief, and a claim under Florida's Deceptive and Unfair Trade Practices Act, Fla. Stat. section 501.201 et seq.

The district court granted the company's Rule 12(b)(1) motion and dismissed for lack of subject matter jurisdiction. It read Ninth Circuit case law to require more: that a plaintiff show "the nature of the information disclosed, the context of the disclosure, and other alleged injuries associated with the disclosure demonstrate an imminent and substantial injury." For that proposition it cited Greenstein v. Noblr Reciprocal Exchange, No. 22-17023, 2024 WL 3886977 (9th Cir. 2024). That disposition, filed August 21, 2024, is stamped "NOT FOR PUBLICATION" and states on its face that it "is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3." The district court concluded the Blacks had not shown a substantial likelihood of future injury.

A unanimous panel of Circuit Judges Michael Daly Hawkins, William A. Fletcher and Eric C. Tung reversed. There is no concurrence and no dissent. Judge Tung opened the opinion with the question and the answer:

"If you entrust a company to keep your sensitive health information private, but the company then discloses that information to others without your consent, have you been injured? We hold yes." Source: Black v. IEC Group, Inc., No. 25-5952, slip op. at 3 (9th Cir. Oct. 9, 2026)

The disposition at the end of the opinion reads simply: "REVERSED AND REMANDED." The panel sent the case back to the District of Idaho "for further proceedings."

Under Federal Rule of Appellate Procedure 40(d)(1), any petition for panel rehearing or rehearing en banc in a civil case with no federal party must be filed within 14 days after judgment is entered. Rule 40 was not among the appellate rules amended effective December 1, 2025, so counting 14 days from the October 9, 2026 filing is our own computation under the rule as published, and it puts the window at roughly October 23, 2026 absent an order shortening or extending it.

Standing to Sue Is Not the Same as Winning

This is the point readers most often miss, so it is worth stating bluntly: the Blacks have not won anything on the merits. Not one of their eight counts has been held valid.

Article III standing is a jurisdictional question about whether a federal court may hear a dispute at all. It comes before any question about whether the plaintiff is right. The panel's own conclusion is limited the same way: the Blacks "have standing here at least at this stage of the pleadings."

The posture matters too. This was an appeal from a motion to dismiss, where, quoting Krottner v. Starbucks Corp., 628 F.3d 1139, 1141 (9th Cir. 2010), "a plaintiff need only show that the facts alleged, if proven, would confer standing." Nothing has been proven. Everything in the complaint remains an allegation, and the opinion does not say whether AmeriBen has raised any merits defenses. None has been decided.

What the ruling changes is that the case now proceeds in federal court instead of ending at the threshold. The ordinary course of a civil case is what lies ahead: further motions, discovery, and, if the case gets that far, summary judgment or trial.

What the Law Actually Says

Article III, section 2 of the Constitution limits federal courts to "Cases" and "Controversies." Out of that phrase the Supreme Court built the standing doctrine, which requires a plaintiff to have suffered an injury in fact that is traceable to the defendant's conduct and that a court can redress.

The hard part in privacy cases is the first element. Physical harm and money lost are easy. Intangible harms are the fight.

In Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), the Court said an intangible harm can be concrete, and that courts should ask "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Spokeo, 578 U.S. at 340-341. The Court added that Congress's judgment about which intangible harms matter is "instructive and important." Id. at 341.

In TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Court sharpened that into a search for a "close historical or common-law analogue for their asserted injury," 594 U.S. at 424, while warning that the inquiry is "not an open-ended invitation for federal courts to loosen Article III," id. at 424-425.

Those two cases set up a fork that explains this whole dispute. A court can ask whether the plaintiff faces a realistic future risk, usually identity theft or fraud, which is how a great many data breach cases get decided. Or it can ask whether the harm the plaintiff already suffered resembles something courts have long compensated. The District of Idaho took the first road. The Ninth Circuit took the second.

The analogue the panel landed on is breach of confidence, which it described as liability for the unconsented, unprivileged disclosure to a third party of nonpublic information the defendant learned inside a confidential relationship. The opinion then traces that action from Coke's Institutes through a line of Chancery cases including Duke of Queensberry v. Shebbeare (Ch. 1758), Yovatt v. Winyard (Ch. 1820), Abernethy v. Hutchinson (Ch. 1825), Prince Albert v. Strange (Ch. 1849) and Morison v. Moat (Ch. 1851), into Joseph Story's equity treatise and then into American decisions, most prominently Justice Holmes's unanimous opinion in E.I. Du Pont de Nemours Powder Co. v. Masland, 244 U.S. 100 (1917).

Judge Tung distilled the point in six words: "a trust betrayed is the harm."

The panel reinforced the analogy with breach of contract, noting that actions for breach were available at common law without any allegation of money lost or physical injury, and that the Blacks allege a confidential relationship grounded in promises AmeriBen made, including in its privacy policy.

Then comes HIPAA, and this part is widely misread. The court invoked the Health Insurance Portability and Accountability Act as congressional confirmation that this category of data is sensitive, nothing more. It said plainly that "the Act does not provide a private cause of action," while noting that HIPAA does prohibit disclosure and, under certain conditions, imposes criminal liability for knowingly disclosing individually identifiable health information. See 42 U.S.C. section 1320d-6(a)(3), whose penalties at section 1320d-6(b)(1) run to a fine of not more than $50,000, imprisonment of not more than one year, or both, and 42 U.S.C. section 1320d(6), which defines individually identifiable health information. If you want the enforcement machinery HIPAA actually does provide, start with what HIPAA requires of health plans and their business associates and with how a HIPAA breach gets reported and to whom.

The panel also addressed whether standing had to be analyzed count by count. It acknowledged that standing "must of course be shown claim by claim and is not 'dispensed in gross'", quoting TransUnion, 594 U.S. at 431, and then stated the principle that produced a single answer here:

"injury in fact turns on the harm a plaintiff has suffered rather than the legal theory he invokes to redress it, and where every count rests on the same injury, that inquiry yields a single answer" Source: Black v. IEC Group, Inc., No. 25-5952, slip op. at 7 (9th Cir. Oct. 9, 2026)

Read closely, that sentence is conditional. The panel did not say that each of the eight counts rests on the same injury, and it did not walk through them. It never analyzes the Florida Deceptive and Unfair Trade Practices Act count separately, and it never separately addresses count seven, the request for declaratory and injunctive relief. That second gap is worth flagging, because the very passage of TransUnion the panel quoted says plaintiffs "must demonstrate standing for each claim that they press and for each form of relief that they seek (for example, injunctive relief and damages)." TransUnion, 594 U.S. at 431.

Our reading is that the panel treated the alleged harm as one harm running through the whole complaint, which is why one answer sufficed for it. That is our inference, not the opinion's statement. On the Florida count the opinion lists it in footnote 1 with its statutory citation and says nothing further, and it never explains why a Florida statute is pleaded in an Idaho case. We are not going to guess at a choice-of-law or plan-terms explanation the opinion does not give. The case was filed in Idaho and one count invokes a Florida statute, so our guides to Florida's data privacy framework and to privacy and breach rules in Idaho cover each state's own regime, alongside the whole state-by-state privacy picture.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The doctrinal move here is the story. In the post-TransUnion period, a standard defense argument in data cases recasts the plaintiff's complaint as a claim about the future. Nobody stole your identity, the argument runs, so come back when somebody does. That framing is powerful because future risk is speculative almost by definition, and speculation does not confer standing. The district court took a version of that road here, asking whether the Blacks had demonstrated a substantial likelihood of future injury and concluding they had not.

The panel answers that by changing the question. If the injury is the betrayal of a confidence, then it is complete when the entrusted data leaves the relationship. Nothing further has to happen. That is why the historical-analogue method matters beyond this case: it lets a plaintiff point at a harm that is already finished rather than one that might arrive. Note the limit built into it, though. Breach of confidence and breach of contract both need a defendant who was entrusted with the information and promised to protect it, so this reasoning does not reach disclosure by a stranger to the plaintiff.

It is worth being precise about what the panel did and did not say regarding other circuits. In footnote 3 the court noted that the Third Circuit has "hesitate[d] to conclude" that breach of confidence was traditionally actionable, citing Barclift v. Keystone Credit Services, LLC, 93 F.4th 136, 145 n.3 (3d Cir. 2024), and that the Seventh and Fourth Circuits have questioned whether breach of contract supports standing when damages are merely nominal, citing Dinerstein v. Google, 73 F.4th 502, 521 (7th Cir. 2023), and Freeman v. Progressive Direct Insurance Co., 149 F.4th 461, 467 (4th Cir. 2025).

The same footnote then pushes back on both. Against the Third Circuit the panel wrote that "breach of confidence" is "anything but new," pointing to the authorities it had just surveyed and to Judge Matey's partial dissent in Barclift, 93 F.4th at 157 and n.13. Against the Seventh and Fourth Circuits it wrote that "it appears to us that nominal damages are a historical recognition that a party is harmed by the very act of the breach itself even when no pecuniary damage accompanies such breach," and compared a nominal breach to a trespasser placing one foot on an owner's land without damaging it.

The panel never used the word split. It closed footnote 3 by saying "the Third, Seventh, and Fourth Circuits did not have occasion to address the particular allegations at issue here," which it described as "a breach of confidentiality grounded in contractual promises to keep sensitive HIPAA-protected health information private," and called their decisions "readily distinguishable." So the panel treats them as distinguishable rather than as opponents. But the footnote also disagrees with their reasoning, so other courts and commentators may read this opinion as in tension with them. Both halves of that footnote belong in any account of it.

Footnote 2 records a second disagreement, on a different question, and in carefully loose language. The panel wrote that sister circuits "have apparently adopted different approaches as to whether the tort's element of 'publicity' needs to be alleged" to establish standing on a disclosure-of-private-information theory, and it lined up the Eleventh, Tenth, Seventh, Third and Fourth Circuits against the D.C., Sixth and Second Circuits. The word is "apparently," and the opinion does not say the question is settled, squarely joined, or resolved; it records that the approaches appear to differ.

Footnote 2 is also where the panel set the broader theory aside. It acknowledged that TransUnion had treated "disclosure of private information" as a harm traditionally recognized in American courts, said that "could potentially provide another basis for standing here," and then said "we need not decide that today." That is the reason this holding is not about disclosure standing on its own. The ground the panel actually used needs a defendant who was entrusted with the data, and the question whether bare disclosure of private information is enough remains open in the Ninth Circuit.

Two other features of the record are worth flagging because they cut against over-reading the ruling. First, the standard the district court applied came from Greenstein, a Ninth Circuit memorandum stamped "NOT FOR PUBLICATION" that states it "is not precedent except as provided by Ninth Circuit Rule 36-3." The appellate opinion does not discuss Greenstein and does not address the "narrower rule" the district court read out of circuit caselaw; it applies the historical-analogue test and reverses.

Second, the opinion says remarkably little about how the disclosure happened, and that is worth stating as an absence rather than filling in. According to AmeriBen's letter as the opinion describes it, an associate emailed a spreadsheet of sensitive health information to "one or more [plan] members," and the information that "may have been disclosed" included first and last names, unique tracking numbers, provider names, claim numbers, dates of service and the amounts billed or paid. The opinion does not call this a hack, does not describe an outside intruder, and does not use the words misdirected or internal. Nor does it say how many people received the spreadsheet. The complaint uses the word breach, and the opinion's own description of the letter says the information was disclosed "to unauthorized parties." The plaintiffs allege that "the full extent of the types of Sensitive Information, the scope of the breach, and the root cause of the breach is all within the exclusive control of the Defendant" and that AmeriBen "has not been forthright with information about the Breach." Notably, the panel never treated the number of recipients as material to standing. It analyzed the character of the relationship and the sensitivity of the information, not the size of the audience. That is an absence in the opinion rather than a holding.

We are not going to predict whether AmeriBen seeks rehearing, whether the Ninth Circuit grants it, whether the Supreme Court ever takes up the publicity question, or how the Blacks' eight counts fare on remand. The opinion resolves one jurisdictional question at the pleading stage, and everything beyond that is open.

How This Affects You

For plaintiffs in a federal district court inside the Ninth Circuit with allegations like these, the ruling says something narrow and real: the panel did not require a showing that identity theft was likely, where the complaint alleges that the entity entrusted with the data promised to keep it confidential and then disclosed it without consent. How far that reasoning carries to a different set of allegations is for later cases.

That is a statement about jurisdiction, not about outcomes. Whether any particular claim is viable turns on the law of the state whose claims are pleaded, the terms of the plan and privacy policy, what the defendant actually promised, and what happened. Other circuits have taken different approaches to related standing questions, as footnotes 2 and 3 of this opinion note, and nothing here changes the rules in the Third, Fourth, Sixth, Seventh or D.C. Circuits.

Two practical points hold regardless of circuit. HIPAA itself gives individuals no private right to sue, and the Blacks pleaded state-law theories such as negligence and breach of contract instead. And a HIPAA complaint is filed administratively rather than in court: the U.S. Department of Health and Human Services Office for Civil Rights enforces the HIPAA Privacy, Security and Breach Notification Rules, and under 45 C.F.R. section 160.306 a complaint must be in writing and normally filed within 180 days of when the complainant knew or should have known of the act complained of.

Nothing in this article tells you whether you personally have standing or a claim. That depends on facts a lawyer has to look at.

This is general legal information, not legal advice. It covers Article III standing in the federal courts of the Ninth Circuit (Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, Washington, Guam and the Northern Mariana Islands) and reflects sources verified on October 10, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Florida's Digital Bill of Rights and breach rules
• What counts as a reportable HIPAA breach
• Our state-by-state guide to US privacy statutes

---

Last updated: 2026-10-10. This is a developing story; details verified as of 2026-10-10.

Frequently Asked Questions

Did the Ninth Circuit say the plaintiffs win their case?

No. Standing is permission to be heard, not a win. Black v. IEC Group, Inc., No. 25-5952 (9th Cir. Oct. 9, 2026), decided Article III standing only, and the panel said the plaintiffs have standing 'at least at this stage of the pleadings.' The court reversed a Rule 12(b)(1) dismissal and remanded for further proceedings, which means the case can go forward, not that any claim has been held valid.

Can I sue under HIPAA if my medical information was sent to the wrong person?

No. The Ninth Circuit stated in this opinion that HIPAA 'does not provide a private cause of action.' The panel cited HIPAA only as evidence that Congress regards this data as sensitive, pointing to 42 U.S.C. section 1320d-6(a)(3) and the definition at 42 U.S.C. section 1320d(6). Private suits over health data disclosures are brought on state-law theories instead, and HIPAA complaints go to the HHS Office for Civil Rights.

Which states does this ruling apply to?

It binds federal courts in the Ninth Circuit. Section 41 of title 28 lists Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, Washington and Guam, and the Northern Mariana Islands are in the same circuit under Pub. L. 95-157 and 48 U.S.C. section 1694(a). It is not binding in any other circuit, and it does not govern standing rules in state courts.

Do I have to show identity theft or fraud to have standing after this decision?

Not on the theory the panel adopted. The district court had required an 'imminent and substantial injury' in the future; the Ninth Circuit instead asked whether the alleged harm resembles a harm courts have traditionally recognized, and found a close analogue in breach of confidence and breach of contract. Both of those require a disclosure by someone the plaintiff entrusted with the information, so the ruling is not that any disclosure on its own confers standing. Whether the same reasoning reaches a different fact pattern is for later cases to decide.

Was this a data breach or a hack?

Per the opinion, AmeriBen's August 2023 letter said an associate emailed a spreadsheet of plan members' health information to 'one or more [plan] members', and that the information that 'may have been disclosed' included names, unique tracking numbers, provider names, claim numbers, dates of service and amounts billed or paid. The opinion does not describe an outside intrusion and does not use the word hack, but it also does not say how the email came to be sent or how many people received it. The complaint uses the word breach, the opinion's description of the letter says the information was disclosed to unauthorized parties, and the plaintiffs allege the scope and root cause are within AmeriBen's exclusive control.

Does this create a circuit split?

The opinion never uses the word split. In footnote 3 the panel called decisions from the Third, Seventh and Fourth Circuits 'readily distinguishable' and said those courts 'did not have occasion to address the particular allegations at issue here.' In the same footnote, though, it wrote that breach of confidence is 'anything but new' and disputed the Seventh and Fourth Circuits' reasoning about nominal damages, so other courts and commentators may read the opinion as in tension with them. Footnote 2 separately notes that circuits have 'apparently adopted different approaches' to whether 'publicity' must be alleged on a disclosure-of-private-information theory, a question the panel expressly declined to decide.

Is the decision final?

The opinion was filed October 9, 2026 and marked FOR PUBLICATION. Under Federal Rule of Appellate Procedure 40(d)(1), which was not among the appellate rules amended effective December 1, 2025, a petition for panel rehearing or rehearing en banc in a civil case without a federal party must be filed within 14 days after judgment is entered. Counting 14 days from October 9 is our own computation under the rule as published, and on that basis the window was still open as of October 10, 2026.