Court Dismisses Lawsuit Over UCLA Health System Data Breach

On Tuesday, a state appellate court dismissed a class-action lawsuit against the University of California over a data breach that exposed the personal information of more than 16,000 patients of the UCLA Health System, Payers & Providers reports.

The ruling states that health care providers are not necessarily liable when medical data are stolen or misappropriated unless the information is accessed by a third party (Payers & Providers, 10/17).

About the Breach

In September 2011, an external hard drive containing personal information of 16,288 UCLA patients was stolen from the home of a doctor working with the UCLA Faculty Group. The records dated from July 2007 through July 2011.

The patient information on the lost hard drive was encrypted, but a piece of paper that had the password to decode the data also went missing (California Healthline, 12/22/11).

However, there was no proof that the data had been accessed by a third party, according to Payers & Providers (Payers & Providers, 10/17).

About the Lawsuit

In 2011, the Los Angeles-based law firm Kabateck Brown Kellner filed a class-action lawsuit in Los Angeles County Court against the regents of the University of California, seeking as much as $16 million in damages over the data breach.

The suit claimed that UCLA Health System violated the California Confidentiality of Medical Information Act, which prohibits health care providers from disclosing patient data without consent.

Attorneys sought damages of $1,000 per member of the class-action suit, as well as legal fees and other costs (California Healthline, 12/22/11).

Reaction to Ruling

In a statement, the California Hospital Association called the ruling "good news for hospitals and other health care providers who are victims of theft or hacking of medical information where the plaintiff cannot prove that the thief or hacker actually viewed the medical information" (Payers & Providers, 10/17).