Regents of University v. Superior Court
220 Cal. App. 4th 549
| Cal. Ct. App. | 2013Background
- In Sept. 2011 an encrypted external hard drive containing UCLA patients' identifiable medical information and the written encryption password were stolen from a physician's home; UCLA notified affected patients that there was no evidence the data were accessed.
- Melinda Platter, a notified patient, filed a class action under the Confidentiality of Medical Information Act (CMIA) seeking $1,000 statutory (nominal) damages per class member, alleging UCLA negligently lost possession of the hard drive and failed to maintain reasonable systems and controls.
- The Regents demurred, arguing CMIA statutory damages (Civ. Code §56.36(b)) require negligent "release" or "disclosure" by the provider—i.e., an affirmative communicative act—not merely negligent storage that allowed third‑party access.
- The superior court overruled the demurrer, reasoning §56.101 (duty to maintain records confidentially) incorporates the remedies of §56.36(b) and thus permits nominal damages for negligent maintenance even absent an affirmative disclosure.
- The Court of Appeal granted the Regents' writ petition and reviewed de novo whether §56.101, by incorporating §56.36(b), authorizes a private statutory‑damages action based solely on negligent maintenance when there is no allegation the records were actually accessed or viewed by an unauthorized person.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether §56.101 + §56.36(b) authorize statutory ($1,000) damages for negligent maintenance/storage absent any unauthorized access or viewing | Platter: CMIA permits recovery where provider negligence is proximate cause of an unauthorized third party obtaining information—no need to plead an affirmative provider disclosure | Regents: §56.36(b) requires a negligent "release"/"disclosure" (an affirmative communicative act); negligent storage without provider disclosure does not support private statutory damages | Court: A private action under §56.101 (incorporating §56.36(b)) requires pleading/proof of a release of the plaintiff's confidential information (i.e., a breach of confidentiality), not mere loss of possession; because Platter alleged no unauthorized access/viewing, demurrer should have been sustained without leave to amend |
| Whether "release" in §56.36(b) is synonymous with "disclose" in §56.10 such that both require affirmative communicative acts | Platter: "Release" covers situations where negligence allows information to be obtained by third parties (broad meaning) | Regents: "Release" = "disclose"; both require affirmative provider communication | Court: "Disclose" and "release" have different ordinary meanings; "release" is broader and can include negligent allowance of escape/access, but still requires a breach (unauthorized access/use) — it need not be limited to affirmative provider communication |
| Whether §56.101's incorporation of §56.36(b) imported only the measure of damages or the entire cause‑of‑action elements | Platter: §56.101 incorporates remedies so nominal damages are available for negligent maintenance alone | Regents: §56.101 only imported the damages measure, not the private‑action elements | Court: Legislature intended incorporation of the remedy (i.e., private cause of action) in §56.36(b), so elements of that cause (including a release/breach) apply to claims under §56.101 |
| Whether pleading "loss of possession" alone suffices to state a CMIA claim for statutory damages | Platter: Allegation that provider lost possession of the hard drive is enough to show negligent release | Regents: Loss of possession without an alleged breach/access is insufficient | Court: Loss of possession alone is insufficient; plaintiff must allege the confidentiality of her information was breached (e.g., unauthorized access/use) to recover statutory damages |
Key Cases Cited
- McCall v. PacifiCare of Cal., Inc., 25 Cal.4th 412 (2001) (demurrer standard and de novo review principles)
- Aubry v. Tri‑City Hosp. Dist., 2 Cal.4th 962 (1992) (pleading and construction rules for statutory causes of action)
- Munson v. Del Taco, Inc., 46 Cal.4th 661 (2009) (statutory incorporation can create a private damages action)
- Lu v. Hawaiian Gardens Casino, Inc., 50 Cal.4th 592 (2010) (courts discern legislative intent to create private remedies and harmonize statutory language)
- Kirkwood v. Bank of America, 43 Cal.2d 333 (1954) (limits on inserting unstated words into statutes)
- Brandt v. Superior Court, 37 Cal.3d 813 (1985) (extraordinary writ relief is disfavored but appropriate for pure legal questions)