I’ve often said that the next tsunami of litigation will be in the area of privacy. There is always talk about a privacy initiative and there are normally numerous bills in the state legislature dealing with the issue. So I was happily surprised when I read that a state appellate court ordered the dismissal of a privacy lawsuit that could have cost Sutter Health more than $4 billion dollars.
The privacy suit stemmed from a break-in on October 15,2011. During the break-in, a computer was stolen that had the records of more than 4 million patients stored on the hard drive in a password protected but unencrypted format.
Once they found out the information was stolen, individual patients began filing lawsuits alleging a violation of California’s Confidentiality of Medical Information Act. Those individual suits became coordinated and a master complaint or class action was proposed. The complaint sought $1,000 compensation for each patient, according to the statute, and the potential award could have totaled more than $4 billion.
However, the three justice panel of the 3rd District Court of Appeal on July 21st declared that the confidentiality statue requires proof that an unauthorized person has accessed the stolen material. They wrote that providing $1,000 in damages to every person whose medical information merely came into the possession of an unauthorized person “would lead to unintended results.”
They continued by saying, “For example, if a thief grabbed a computer containing medical information on 4 million patients, but the thief destroyed the electronic records to reformat and wipe clean the hard drive and sell the computer without ever viewing the information or knowing it was on the hard drive, the health care provider would still be liable, at least potentially, for $4 billion. For all we know, that may have occurred here.”
I am glad to see that reason prevailed in this case and $4 billion dollars can be spent on patient care, instead of plaintiffs’ lawyers seeking to profit – especially since no one knows if patient privacy was even compromised. I applaud the 3rd District Court for their ruling.