California Court Of Appeal Addresses Predominance Requirement For Class Certification In CMIA Case For The First Time In Published Decision

• Published date: 01 November 2022
• Subject Matter: Litigation, Mediation & Arbitration, Food, Drugs, Healthcare, Life Sciences, Class Actions, Trials & Appeals & Compensation
• Law Firm: Arnold & Porter
• Author: Mr Kenneth Chernof, Angel T. Nakamura, Stephanie Kang, Hannah Coleman and Kristina Iliopoulos

On October 18, 2022, the California Court of Appeal certified for publication its opinion in Maria Vigil, Inc. v. Muir Medical Group IPA, Inc., No. A160897 (Vigil), which is the first published decision in California to address the predominance requirement for class certification in a case brought under the California Confidentiality of Medical Information Act (CMIA). The decision not only reaffirms the "actual viewing" requirement for a private cause of action under Section 56.36 of the CMIA, but more importantly establishes that a breach of confidentiality under the CMIA cannot be shown on a class-wide basis because individual issues would predominate.

The CMIA's "Actual Viewing" Requirement

The two seminal California Court of Appeal decisions on the CMIA are Regents of University of California v. Superior Court, 220 Cal. App. 4th 549 (2013) and Sutter Health v. Superior Court, 227 Cal. App. 4th 1546 (2014). These cases hold that a plaintiff may only bring a private right of action under Section 56.36 of the CMIA if they can prove that an unauthorized third person in fact "actually viewed" their confidential medical information as a result of the defendant's alleged negligence.¹ In both cases, the court held that courts must dismiss a CMIA data breach lawsuit unless the named plaintiffs provide evidence that their information was actually viewed by a third party. This is because Section 56.36 only permits a private right of action when there has been an "actual breach of confidentiality," and "[n]o breach of confidentiality takes place until an unauthorized person views the medical information."²

The Vigil Decision

The plaintiff in Vigil filed a class action alleging that Muir Medical Group violated the CMIA by negligently releasing class members' confidential medical information as a result of a data breach that occurred in December 2017.

The Vigil decision addresses two key issues that are regularly litigated in CMIA cases: (1) whether a private cause of action under Section 56.36 of the CMIA requires the plaintiff to prove with evidence that an unauthorized third party "actually viewed" the individual plaintiff's confidential medical information and (2) whether, in light of this "actual viewing" requirement, a private claim for breach of confidentiality under the CMIA can be established on a class-wide basis.

In addressing these issues, the Vigil decision relies on and reaffirms the findings in Regents and Sutter Health that a breach of...