By Gerald L. Maatman, Jamar Davis, and Caitlin Capriotti
Duane Morris Takeaways: On October 9, 2026, in Melissa Black and Miles Black v. IEC Group, Inc., No. 25-5952, 2026 U.S. App. LEXIS 30906 (9th Cir. Oct. 9, 2026), a panel for the Ninth Circuit, via an opinion written by Judge Eric. C. Tung, reversed the decision by the U.S. District Court for the District of Idaho dismissing a privacy class action for lack of subject matter jurisdiction for lack of injury. In the reversal, the Ninth Circuit held that the unauthorized disclosure of sensitive facts about Plaintiffs’ health that they entrusted Defendant to keep private is akin to a breach of confidence or contract. The act of disclosure, even without a formal privacy right, is an intangible harm sufficient for Article III standing. The case was remanded back to the District Court for further proceedings.
The decision is a must read for corporate counsel dealing with privacy class actions.
Case Background
Plaintiffs Miles and Melissa Black (“Plaintiffs”) receive health insurance from a plan administered by Defendant IEC Group, Inc. (“IEC”). Id. at *3. In August 2023, IEC sent Plaintiffs a letter informing them that some of their information was disclosed to unauthorized parties when an associate emailed a spreadsheet containing Plaintiffs’ sensitive health information to “on or more [plan] members.” Id. at *4. Information disclosed included: (1) first and last names, (2) unique tracking numbers, (3) provider names, (4) claim numbers, (5) dates of service, and (6) the amounts billed or paid. Id.
Plaintiffs brought a class action against IEC in the U.S. District Court for the District of Idaho claiming that when Plaintiffs entrusted their sensitive health information to IEC as a condition of their healthcare plan administration, IEC expressly and impliedly promised – through its Privacy Policy – to keep the information confidential and to not disclosure it to any third party without their consent, and to use reasonable methods to prevent such disclosure. Id. Plaintiffs allege that IEC breached those promises when they disclosed the confidential information without authorization, depriving Plaintiffs the benefit of their bargain and diminishing the value of the services rendered. Id.
The District Court granted IEC’s Rule 12(b)(1) motion to dismiss for lack of subject matter jurisdiction because it concluded that Plaintiffs did not suffer an injury in fact and thus did not have Article III standing. Id. at *5. The District Court held that to allege a concrete injury from disclosure of personal information, the Plaintiffs must show that the nature of the information disclosed, the context of the disclosure, and other alleged injuries associated with the disclosure demonstrate an imminent and substantial injury. Id.
The Ninth Circuit’s Analysis
The Ninth Circuit reversed. It began its ruling by reiterating the long-held standard that an “injury in fact” includes both tangible harms, such as physical harms or monetary loss, and traditionally recognized intangible harms, such as “reputational harms” or “harms specificized by the Constitution itself.” Id. at *6. The Ninth Circuit also opined that “Congress’s ‘judgement is also instructive and important,’ as that body is ‘well positioned to identify intangible harms that meet minimum Article III requirements.’” Id. at *7 (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016)).
In this case, the harm Plaintiffs alleged consisted of the unauthorized disclosure of sensitive facts about their health that they entrusted to IEC to keep private. Id. At this stage of litigation, there is no dispute that the disclosed information was sensitive to Plaintiffs nor that IEC promised Plaintiffs to keep this information private. Id. Thus, the harm that Plaintiffs allege from the disclosure resembled a breach of confidence and breach of contract, which courts have long held provides basis for a lawsuit. Id.
Under a breach of confidence claim, a defendant is liable for “the unconsented, unprivileged disclosure to a third party of nonpublic information that the defendant has learned within a confidential relationship. Id (citing Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114 (3d Cir. 2019)). The panel described cases going back to 1614 England to demonstrate this long held cause of action. See id *8-12. Ultimately, for a breach of confidence, “a trust betrayed is the harm.” Id. at *12 (emphasis in original). Further, the Ninth Circuit held that a privacy right is not necessary to find a breach of confidence claim. Id. at 13. A “breach of contract” claim only reinforces the breach of confidence standing. Id. at 15. Here, Plaintiffs have alleged a confidential relationship grounded in promises made by IEC, and a breach of those promises. Id.
Finally, the Ninth Circuit reasoned that Congress has confirmed that disclosure of private health information is a concrete injury through other legislation. Id. at 16. Congress passed the Health Insurance Portability and Accountability Act (HIPAA) and subsequent amendments to protect certain sensitive health information from improper disclosure. Id. While HIPAA does not provide a private cause of action, it does prohibit disclosure of private health information and even provides criminal liability for “knowingly ‘disclos[ing] individually identifiable health information to another person.’”Id (citing 42 U.S.C. § 1320d-6(a)(3)). Congress has made the determination that this information is sensitive enough to warrant statutory protection. Id. Thus, a disclosure of the private health information is a harm sufficient for Article III standing.
Implications for Companies
This case highlights the importance of maintaining confidentiality when handling sensitive personal information of their employees and customers. The Ninth Circuit has held that even if a private cause of action regarding privacy for a specific kind of sensitive information does not exist, unauthorized disclosure is itself harm in the context of Article III. Employers must ensure that their security protocols and storage of sensitive information passes muster in the digital age in order to avoid potential liability