On April 29, 2021, Scripps Health (\u201cScripps\u201d) suffered a ransomware attack in the unauthorized access of over 147,000 patients\u2019 personal information. A few weeks later, Scripps announced the breach. As of writing this article, Scripps is still trying to determine the full extent of damage caused by the breach. <\/p>\n\n\n\n
I previously wrote about the CCPA and California\u2019s plaintiff\u2019s rights in the event of a data breach. This article will explore California\u2019s Plaintiff\u2019s rights against healthcare providers in the event of a data breach. <\/p>\n\n\n\n
Scripps is a private non-profit organization and one of San Diego\u2019s largest healthcare providers. Scripps also processes the personal information of over 50,000 California residents. Scripps seemingly fits the description of a qualified business under CCPA 1798.140. However, the CCPA actually does not apply to Scripps for a few reasons. <\/p>\n\n\n\n
First, Scripps is a non-profit private business, and the CCPA specially states that non-profit entities are exempt from this law. This also means that there can be no private right of action under the CCPA for those individuals who have been affected by this breach. <\/p>\n\n\n\n
Second, because Scripps is a healthcare provider, it is required to abide by the Health Insurance Portability and Accountability Act (\u201cHIPAA\u201d) and Health Information Technology for Economic and Clinical Health (\u201cHITECH\u201d). Generally, all private businesses that conduct business in California and control data including personal information are subject to data breach notification laws under the Customer Records Act (Cal. Code. Civ. \u00a7 1798.82). Further, under California law, personal information includes \u201cmedical information\u201d which is defined as any information regarding an individual\u2019s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.\u201d (Cal. Code. Civ. \u00a7 1798.81.5.) However, HIPAA and HITECH are federally regulated. Given that Scripps is a healthcare provider defined by HIPAA and HITECH, California rules regarding breach notification generally play second fiddle to the federal regulations. In fact, 1798.81.5(e)(5) states that compliance with these federal laws \u201cshall be deemed compliance with this section\u201d regarding disclosure. <\/p>\n\n\n\n
HIPAA and HITECH have tighter standards for breach notification than most state laws. Unfortunately, there is also no private right of action for HIPAA or HITECH violations, including widespread data breaches like the Scripps incident. (See Acara v. Banks<\/em> (5th Cir. 2006) 470 F.3d 569, 571. \u201cEvery district court that has considered this issue is in agreement that the statute does not support a private right of action.\u201d) This doesn\u2019t necessarily preclude Plaintiff\u2019s from filing lawsuits. In fact, Plaintiffs may be able to file lawsuits for damages resulting from violations of state laws. <\/p>\n\n\n\n For instance, Section 56.101(a) of the California civil code requires healthcare providers such as Scripps to preserve the confidentiality of medical information. (Cal. Code. Civ. \u00a7 56.101.) Any healthcare provider who negligently fails to preserve this confidentiality \u201cshall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.\u201d (Id.<\/em>) This seemingly opens the door for lawsuits against data breaches by healthcare providers. Indeed, there has been an increase in class action lawsuits involving data breaches by healthcare providers in California. However, the court in Sutter <\/em>has made it more difficult to prove a breach of confidentiality under 56.101(a). <\/p>\n\n\n\n In Sutter<\/em>, the court stated a plaintiff must allege that negligently released medical information was viewed by an unauthorized person. (Sutter Health v. Superior Court<\/em> (2014) 227 Cal.App.4th 1546, 1557 [174 Cal.Rptr.3d 653] \u201cNo breach of confidentiality takes place until an unauthorized person views the medical information.\u201d) In Sutter<\/em>, Sutter Health had a computer stolen from one of its offices, wherein the computer contained medical records of over four million patients. (Id.<\/em> at 1551.) The computer\u2019s hard drive was password-protected but the files themselves were unencrypted. (Id.<\/em>) The court briefly compared their facts to Regents<\/em>, where the data thief stole both the encrypted information and the encryption key, clarifying that this was to \u201ctantamount to leaving the files unencrypted.\u201d (Id.<\/em> at 1555, citing encryption Regents of University of California v. Superior Court<\/em> (2013) 220 Cal.App.4th 549, 554 [163 Cal.Rptr.3d 205].) The facts in regents arguably show a more clear-cut case of the release of unencrypted personal information. However, the court in Sutter<\/em> seemingly ignored any arguments of encrypted versus unencrypted. Instead, the court determined that, because there was no allegation that the released medical information had been viewed<\/strong> by an unauthorized party, there can be no breach of confidentiality. (Sutter<\/em> at 1557.) <\/p>\n\n\n\n