For organizations that share health information, “no evidence of identity theft” is reassuring only up to a point. A recent Ninth Circuit decision explains why: the loss of confidentiality can itself be the injury that allows a patient to sue in federal court. In Black, et al. v. IEC Group, doing business as AmeriBen, decided October 9, 2026, the court held that patients adequately alleged a concrete injury from the unauthorized disclosure of health information they had entrusted to the company. They did not need to allege identity theft or financial loss to clear the standing hurdle.
Providers, health plans, HIEs, and their vendors should pay attention.
The incident described in the opinion involved something considerably less exotic than a sophisticated cyberattack. All it took was an employee emailing a spreadsheet to the wrong people.
What happened?
Miles and Melissa Black received health coverage through a plan administered by AmeriBen. In August 2023, AmeriBen notified them that an associate had emailed a spreadsheet to one or more other plan members. Information potentially disclosed included their names, tracking numbers, provider names, claim numbers, dates of service, and amounts billed or paid. The plaintiffs alleged that only AmeriBen knew the full scope and cause of the disclosure. (Opinion at 3-4.)
The Blacks alleged that AmeriBen had promised to keep their information confidential, including through its privacy policy, and that they relied on those promises when providing their information. Their proposed class action asserted several state-law claims, including negligence and breach of contract. The district court dismissed the case for lack of Article III standing. Standing requires a concrete injury fairly traceable to the defendant’s conduct that a favorable court decision is likely to redress. The district court concluded that the Blacks had not adequately alleged that injury. The Ninth Circuit disagreed. It focused on the alleged disclosure that had already occurred and the confidential relationship in which AmeriBen obtained the information. That harm resembled breach of confidence, a wrong courts have recognized for centuries. The alleged breach of contractual promises reinforced the comparison. The court put it succinctly:
“a trust betrayed is the harm.” (Opinion at 12.)
The case went back to the district court. To be clear, the plaintiffs cleared the standing hurdle; they did not win the lawsuit. The court did not establish liability, award damages, or certify a class. The plaintiffs still must prove their claims, including any disputed contractual obligations. Also, although HIPAA supported the court’s reasoning, but it did not create a right to sue. HIPAA has no private cause of action. Instead, the court viewed Congress’s protection of identifiable health information as further support for recognizing the injury. (Opinion at 16.)
Three details worth noting
First, the informationitself. This case did not depend on exposure of a diagnosis or psychotherapy note. The court explained that claims details, including provider identity, treatment dates, and amounts billed, can reveal private concerns such as mental health treatment or fertility care. (Opinion at 16-17.) So, “it was only billing data” is not a free pass. A spreadsheet does not need a column labeled “diagnosis” to tell a stranger more than the patient wanted to share.
Second, the recipient. The alleged disclosure to one or more other plan members was enough here; the information did not have to reach the entire internet or a criminal. The court relied on the breach-of-confidence comparison and left the separate public-disclosure theory unresolved. (Opinion at 14-15 n.2.)
Third, the promises. Read your privacy notices, website statements, patient agreements, and exchange contracts alongside what your systems actually do. In Black, the alleged promises and the patients’ reliance mattered. For an HIE or vendor without a direct patient relationship, the source and scope of any confidentiality obligation need closer analysis. Participants are not automatically in the same position as AmeriBen.
What about HIEs?
For HIEs and other exchange participants, my concern extends to an incorrectly routed message, an overbroad extract, or a recipient’s use beyond an approved purpose. Black did not decide those scenarios; but its reasoning gives plaintiffs an argument that unauthorized disclosure of sensitive information entrusted to an organization can itself establish injury. An approved connection or a familiar business partner does not answer whether a particular disclosure was permitted.
An organization disclosing information improperly is also different from a recipient later misusing information that was properly disclosed. Black does not automatically make the original sender responsible for the recipient’s conduct. And it does not change HIPAA’s allowed pathways for treatment, payment and health care operations, which allow many disclosures without patient authorization, subject to applicable conditions and other law.
Black is also worth considering in the patient class actions involving Epic, healthcare providers, and Health Gorilla. The early Fox, Beaudreau, and Banh cases were filed in Wisconsin and later voluntarily dismissed. However, an August 7 order centralized nine related patient cases in the Southern District of Florida, including a later California Fox action. Those patients allege that their records were obtained through the exchange network for improper purposes and that organizations responsible for those records failed to protect them. Black could potentially help them argue that the disclosure itself caused an injury without identity theft, financial loss or other harm. Epic’s own allegations may supply factual material for patient plaintiffs, but acknowledging an improper disclosure does not establish who is legally responsible. Each defendant’s obligations, conduct, and connection to the injury still matter. An organization can allege it was deceived and still face questions about its own safeguards.
That said, Black has geographic limits. Its holding on Article III standing is binding precedent only within the Ninth Circuit, which covers Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, and Washington, plus Guam and the Northern Mariana Islands. In the Florida proceeding, Black is persuasive rather than controlling authority because Florida is in the Eleventh Circuit.
In Hunstein v. Preferred Collection & Management Services, Inc., 48 F.4th 1236, 1245–48 (11th Cir. 2022) (en banc), the Eleventh Circuit rejected a standing theory based on the historical tort of public disclosure of private facts because the alleged transfer to a mailing vendor lacked the required publicity. Black relied on a different historical analogy: breach of confidence, grounded in the alleged relationship of trust and promises to keep the information confidential. That gives plaintiffs a basis to distinguish Hunstein, but it does not settle the standing question. The Florida court must still apply controlling Supreme Court and Eleventh Circuit precedent to the facts alleged against each defendant.
Practical takeaways
Hospitals, health plans, HIEs, and their vendors can use the Black decision to sharpen their review of information sharing and incident response. Here are a few items I’d start with:
- Check the scope of purpose of use and the permission. Identify the recipient, actual use, and legal and contractual authority for each material exchange. Verify required consent, sensitive-data restrictions, and minimum necessary limits where applicable.
- Compare the approved exchange with the actual output. Test routing, patient matching, data fields, access controls, and downstream recipients. Include claims feeds, email, and spreadsheets.
- Review confidentiality commitments with counsel. Compare privacy notices, patient agreements, HIPAA BAAs, and exchange contracts with actual practices. Correct inaccurate language and operational gaps.
- Investigate beyond financial misuse. Bring privacy, security, exchange operations, and counsel together. Work with exchange partners to establish whose records went where, what recipients accessed or retained, and whether information traveled further. Document containment and mitigation.
- Assess notification duties and litigation exposure separately. Evaluate applicable claims and legal and contractual reporting duties. Track deadlines and document the facts, uncertainty, and reasons for each decision.
Lawful exchange should continue, with permissions and controls that match what is actually being shared and why. When something goes wrong, an organization’s assessment must address the loss of confidentiality itself. No evidence of financial loss or threat of identity theft may be a relevant finding, but it’s not the end of the analysis. This case is a reminder that the patient’s bank account is not the only thing the law protects.