Class Certification Denied In California Data Breach Case

The October 18, 2022, decision in Vigil v. Muir Medical Group IPA., Inc. by the Court of Appeal of the State of California, First Appellate District Division Two provides a sound legal basis to defeat class certification in data breach cases against health care providers alleging violation of California's Confidentiality of Medical Information Act (CMIA). This decision is a boon for defendants since violations of CMIA may result in statutory damages, even in the absence of actual damages, in the context of the unauthorized disclosure of medical information.

Background

Plaintiff Maria Vigil filed a class action against Muir Medical Group IPA, Inc. (Muir) claiming that Muir failed to adequately protect patients' data, thereby allowing a former employee to download on a spreadsheet private medical information belonging to nearly 5,500 patients, which she took with her when she left her employment at Muir.