As instances of medical data breaches increase, U.S. courts are interpreting the scope of liability stemming from them. In California, the court in Sutter Health et al. v. The Superior Court of Sacramento County (Atkins) held that patients can only recover damages if they can prove that their protected medical information was actually viewed by an unauthorized person. Meanwhile, in Travelers Indem. Co. of Am. v. Portal Healthcare Solutions LLC, a Virginia federal court found that insurers must defend class actions alleging that their insureds posted confidential records online if their policies cover publication of the information, regardless of whether the records were actually viewed.
California: Were stolen medical records viewed by unauthorized persons?
The California Confidentiality of Medical Information Act (CMIA) provides for nominal damages of $1,000 per patient against health care providers who negligently allow the unauthorized disclosure of their patients’ medical information. In October 2011, a thief broke into a Sutter Health office and stole a desktop computer containing more than four million patients’ password protected, but unencrypted, medical records. Sutter Health announced the breach in November 2011. Certain patients’ individual lawsuits for nominal damages under the CMIA soon followed, and were ultimately coordinated in a class action, exposing Sutter Health to a potential $4 billion liability. Though the trial court denied Sutter Health’s demurrer, the appellate court found that, while the CMIA prohibits unauthorized disclosure of medical information, the records at issue were not “disclosed” to the thief as it was not done voluntarily. However, the CMIA imposes “broader duties” by requiring that such information be kept confidential. Specifically, health care providers must preserve the confidentiality of such records, but no breach of that confidentiality occurs, according to the Sutter Health Court, unless “an unauthorized person views the medical information.” Therefore, the fact that a thief possessed protected medical information, absent the allegation that the information was indeed viewed, does not give rise to a cause of action for nominal damages under the CMIA. The court emphasized that the CMIA is not named the “Possession of Medical Information Act.”
Virginia: “The act or process of making known something that was previously unknown.”
Conversely, under Virginia law, confidential medical information is published and disclosed when it is posted online, even unintentionally, and even when there is no evidence a third party viewed that information. Indeed, even in suits where the only evidence was that patients viewed their own information online by searching for their names and finding their medical records, “publication” and “disclosure” had occurred, obligating an insurer’s defense of the underlying action. The definition of publication does not hinge on third-party access.
Travelers insured Portal Healthcare Solutions, a business specializing in the electronic safekeeping of medical records, from claims arising from the records’ publication. After the medical records of Glen Falls Hospital patients were mistakenly posted online, a class action was filed against Portal for failing to safeguard them. Travelers then sought a declaratory judgment that it had no duty to defend Portal, its insured, against such claims, arguing that Portal’s actions did not constitute “publication” or “disclosure” of confidential information, both coverage prerequisites. The Eastern District of Virginia relied on Black’s Law Dictionary’s definition of “disclosure” as “[t]he act or process of making known something that was previously unknown; a revelation of facts.” Unlike the Sutter Health court’s interpretation, the Travelers court found that this definition allows for involuntary disclosure, and moreover, found disclosure occurred even if the information was not made “known” to any third-party. Because the underlying class action therefore contained enough allegations to constitute publication and disclosure of protected confidential information within the meaning of the subject policies, Travelers was directed to defend Portal.
©2026 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.
