UC Regents v. Platter
On October 15, 2013, the California Court of Appeal in the Second Appellate District, consistent with CMA’s amicus letter brief, issued a published opinion in Regents of the University of California v. Superior County of Los Angeles County (Platter), a case interpreting the application of statutory nominal damages under the Confidentiality of Medical Information Act (CMIA).
This class-action lawsuit arose from the theft of a computer hard drive containing confidential information on approximately 16,000 patients. The plaintiffs alleged that the UC Regents negligently lost possession of the hard drive in violation of the CMIA and sought $1,000 in nominal damages for each of the 16,000 patients for a total of $16 million in “nominal” statutory damages. The trial court held that plaintiffs could seek nominal damages under the CMIA even where there are no allegations that confidential information was affirmatively released or that the patients suffered any harm. CMA filed an amicus letter brief arguing that the trial court’s ruling would result in damages that are disproportionate to the underlying violations or actual harm suffered by the plaintiffs. The brief explained that such exorbitant damages could have a dire financial impact on healthcare providers, which would directly undermine the viability of their practices and their ability to provide medical care. The brief argued that CMIA’s provisions should be applied in a way that balances the protection of privacy of patient medical information without placing excessive burdens on healthcare providers.
The court agreed with CMA’s position and held that a private cause of action for statutory damages based on negligent storage or maintenance of confidential medical information requires pleading and proof that the plaintiff’s confidential information was released to a third party. The court explained that allegations of negligent maintenance and loss of possession is insufficient to state a cause of action under the CMIA, and the plaintiff must plead and prove that the confidential nature of the plaintiff’s medical information was breached as a result of the healthcare provider's negligence.