By Gerald L. Maatman, Jr., Jennifer A. Riley, Ryan T. Garippo, and Jamar D. Davis
Duane Morris Takeaways: On May 14, 2026, in J.M. v. Illuminate Education, Inc., No. S286699, 2026 Cal. LEXIS 2657 (May 14, 2026), the California Supreme Court held that the California Court of Appeal decision to deny a demurrer was improper for an incorrect application of privacy laws. This decision emphasizes why defendants should confirm whether a plaintiff sufficiently pled a cause of action that aligns with the remedies that he or she seeks to recover. Further, the opinion clarifies that injury under the Confidentiality of Medical Information Act, Cal. Civ. Code § 56, et seq. (“CMIA”) depends on whether the company subjects medical information to a substantial risk of unauthorized use or access, not whether the unauthorized user actually views sensitive data.
Case Background
Illuminate Education, Inc. (“Illuminate”) is a technology company that helps educators determine the academic progression of an individual student, as well as their areas of potential improvement. The company uses data from individual students, including medical data, to make these determinations. Illuminate provided its services to the Ventura County Office of Education, under which Plaintiff (a minor) was a student. Plaintiff provided his medical information to the Ventura County Office of Education, which then provided Plaintiff’s health data to Illuminate.
In 2022, Illuminate became aware of suspicious activity related to its systems. Illuminate promptly initiated an investigation. The investigation confirmed an unauthorized user gained access to Illuminate’s records, including students’ medical information. Illuminate sent a notice to the guardians of the affected students, including Plaintiff, informing them of the scope of the potential disclosure. The notice made it clear that Illuminate found no evidence that the unauthorized user (or users) was successful in actual or attempted misuse of the data.
After the breach, Plaintiff alleges that he received several mail solicitations at an address provided to only the Ventura County Office of Education. As a result, Plaintiff filed a class action lawsuit alleging that Illuminate, as health care provider, negligently managed the students’ medical records under the CMIA and failed to expediently disclose the data breach to those affected under the Customer Records Act, Cal. Civ. Code § 1798.80, et seq. (“CRA”).
The trial court sustained Illuminate’s demurrer, without leave to amend, after Plaintiff twice failed to cure deficiencies in his pleadings. The Court of Appeal reversed that decision, holding that the trial court abused its discretion by sustaining the demurrer, because Plaintiff may have been able to cure the defects in his complaint if a different legal analysis was applied.
Following that decision, the California Supreme Court set out to resolve the disagreement.
The California Supreme Court’s Decision
The California Supreme Court’s analysis hinges on its statutory interpretation, involving the plain reading of the statutes and their legislative histories. Generally, this analysis fell into three distinct categories.
First, Justice Goodwin Liu, writing for the California Supreme Court, reasoned that Plaintiff failed to establish a valid claim under CMIA because he could not allege that Illuminate was a “provider of health care” under California Civil Code section 56.06. Relying on the text of section 56.06, the Supreme Court explained there are two ways for a business to qualify as a “provider of health care”: (1) a covered business maintains medical records to make the information available to either an individual or a health care provider upon request of the individual or provider; or (2) a covered business makes medical information available for an individual or a health care provider upon request to allow an individual to manage their information, or to help diagnose or treat the individual.
The Supreme Court also confirmed this interpretation by relying on the legislative history of the statutes. The Supreme Court observed that the legislative history confirmed that the legislature was concerned with situations where diabetics used a data platform to record glucose levels, or where people with hypertension used platforms to track their blood pressure. Relying on the legislative history, the Supreme Court observed that Plaintiff never alleged that Illuminate created a repository of student records that allowed the students to create their own records, or to access and share those records at their discretion. Instead, Plaintiff asserted that Illuminate stored medical information to help educators monitor, evaluate, and address student needs. As a result, Illuminate was not a “provider of health care,” because it did not make medical records available upon request of the individual or provider.
The Supreme Court also quickly addressed Plaintiff’s inability to satisfy the alternative method for determining whether Illuminate is a “provider of health care” because Plaintiff never alleged that Illuminate “provides medical information to health care providers or individuals for diagnosis and treatment of an individual.” Illuminate Education, 2026 Cal. LEXIS 2657, at *12. As a result, and after quickly dispensing with a few other arguments, the Supreme Court concluded that Illuminate was not a “provider of health care” under the CMIA.
Second, in addition to analyzing whether Illuminate was a “provider of health care,” the Supreme Court also determined whether Plaintiff had alleged sufficient injury to state a claim under the CMIA. The Supreme Court disagreed with Illuminate’s argument that injury requires an unauthorized person to view medical data, and ruled that a plaintiff alleges injury by claiming that the medical information was exposed to “a significant risk of unauthorized access or use.” Id. at *29.
The CMIA requires covered entities to “preserve[] the confidentiality” of medical information. Cal. Civ. Code § 56.101(a). The Supreme Court stated that “confidentiality” requires “keeping information private or secret” and clarified that this obligation applies regardless of whether an unauthorized party actually views the data. Illuminate Education, 2026 Cal. LEXIS 2657, at *26. (“[W]e reject the rule that no breach of confidentiality has occurred until medical information is actually viewed by an unauthorized person.”). Instead, the determination of whether a covered entity failed to preserve the confidentiality of data depends on a factor-based analysis that considers the “form, duration, and extent of the data breach, as well as any mitigation efforts by the covered entity.” Id. at *30. Thus, a plaintiff need not allege that his or her data was “actually viewed” by a third party, because that person is “unlikely to know what an unauthorized party has done with their data unless they suffer actual damage” and instead “[a]ll relevant circumstances must be considered” when determining whether confidentiality was breached. Id.
Third, for the CRA claim, the Supreme Court ruled that Plaintiff did not state a cause of action against Illuminate because Plaintiff was not a customer within the meaning of the statute. To bring suit under the CRA, a plaintiff must establish that he or she is a “customer” within the meaning of the statute. Boorstein v. CBS Interactive, Inc., 222 Cal. App. 4th 456, 467 (2013). A customer is “an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.” Cal. Civ. Code § 1798.80(c). Here, the Supreme Court found that Plaintiff never alleged that he provided any personal information to Illuminate to purchase or lease a product, or obtain a service from Illuminate. The Supreme Court observed that the Ventura County Office of Education purchased Illuminate’s services and provided the student information, not Plaintiff. Moreover, the Supreme Court disregarded Plaintiff’s argument that he was the “ultimate” customer of Illuminate because the CRA “does not authorize suit by all consumers or beneficiaries; it authorizes a civil action for an injured ’customer.’” Id. at *32.
In the end, the Supreme Court reversed the judgment of the Court of Appeal and remanded the matter for further proceedings.
Implications For Companies
This decision emphasizes the importance of ensuring that a plaintiff has sufficiently pled all causes of action asserted. When the CMIA or CRA are involved, companies must consider whether they are, in fact, a covered entity in order to determine whether they are subject to the statutes’ reach.
Further, to assert injury under the CMIA for a data breach claim, the analysis hinges on the risk of unauthorized use, not what an unauthorized user is able to do with the data. Thus, it is imperative that companies take all reasonable steps to retain the confidentiality of sensitive records, making an extra effort to ensure that hardware is secure.
For CRA claims, companies need to pay special attention to which entities solicit or contract for their services as attention to these details can potentially thwart a potential CRA claim.
In short, organizations that use such medical data, and operate in California, should take note of this decision because it impacts their defenses both positively and negatively going forward.














