An associate emailed confidential health records to the wrong plan members
One emailed spreadsheet unlocked a federal class action and a Ninth Circuit ruling that changes how health data breaches play out in court.
In August 2023, IEC Group - a benefits administrator operating as AmeriBen - sent letters to two health plan members with an uncomfortable admission. An associate had emailed a spreadsheet containing their confidential health information to “one or more plan members.” The data that may have been exposed included names, provider names, claim numbers, dates of service, and amounts billed or paid.
The two plan members sued. They filed a class action in the US District Court for the District of Idaho, alleging negligence, breach of contract, breach of fiduciary duty, and unjust enrichment, among other claims. Their core argument: they had entrusted sensitive health data to IEC Group as a condition of plan administration, the company had promised through its privacy policy to keep it confidential, and it failed.
The district court threw the case out. It found the plan members had not suffered an “injury in fact” - the concrete harm required under Article III of the Constitution before a federal court can hear a case. Without proof of downstream damage like identity theft or financial loss, there was no standing to sue.
The Ninth Circuit saw it differently. In a decision filed on October 9, 2026, a three-judge panel reversed, holding that the unauthorized disclosure of sensitive health information entrusted under a confidential relationship is itself enough harm to get into court. The court traced “breach of confidence” back centuries through English equity courts and American common law, landing on a pointed summary: “a trust betrayed is the harm.”
The panel also looked to Congress, noting that Health Insurance Portability and Accountability Act (HIPAA) was enacted specifically to protect this kind of information - and that even seemingly routine data points like a provider’s name or a date of service can reveal deeply private health concerns. A psychiatrist visit. A fertility clinic. The numbers tell a story.
The ruling drops into a live disagreement among federal circuits over what kind of data disclosure clears the standing bar. The Ninth Circuit has now set a clear marker: no financial loss required.
For HR teams outsourcing benefits administration, the message is direct. A vendor’s data handling mistake can now trigger federal litigation without affected employees first having to prove they lost money.
