Back to Industry

Industry - Data Breach

moderateAnti-Privacy → Data Breach

Executive Summary

The California Supreme Court ruled that plaintiffs can sue over medical record data breaches without proving their information was actually viewed by unauthorized parties. However, the court dismissed a student's lawsuit against educational contractor Illuminate Education over a 2022 breach, finding the company did not qualify as a healthcare provider under state confidentiality laws and that student educational assessments do not constitute medical information. The decision clarifies when Ca...

data-breach

What Happened

On May 14, 2026, the California Supreme Court issued a unanimous ruling in a case involving a 2022 data breach at Illuminate Education, an educational contractor working with the Ventura County Office of Education. The court ruled that plaintiffs can sue over medical record data breaches without needing to prove their information was actually viewed by unauthorized parties. However, the court dismissed the student's lawsuit against Illuminate Education, finding that the company does not qualify as a healthcare provider under California's Confidentiality of Medical Information Act (CMIA) and that student educational assessments do not constitute medical information under the law.

Who Is Affected

The ruling affects California residents who experience data breaches involving their information held by educational contractors like Illuminate Education. While the decision makes it easier for patients to sue healthcare providers over data breaches by eliminating the requirement to prove unauthorized viewing, it narrows protections for students whose educational assessment data is breached. The specific 2022 breach involved students in districts contracting with Illuminate Education, including those under the Ventura County Office of Education.

Why It Matters

This decision establishes important precedent for California privacy law by clarifying that proof of actual unauthorized viewing is not required for medical record breach lawsuits, lowering the barrier for patients to seek legal remedies. However, it simultaneously creates a gap in student privacy protection by determining that educational contractors handling student assessment data, even including dyslexia screenings, are not subject to the same healthcare confidentiality standards. The ruling draws a legal distinction between educational assessment data and medical information that may leave student health-related data more vulnerable to inadequate breach protections.

What You Should Do

If you are a California resident who received notification of a healthcare data breach, you can now pursue legal action without needing to prove your records were actually viewed. Parents of students whose data is held by educational contractors should contact their school districts to understand what privacy protections apply to their children's information and request details about data security practices. Monitor your children's information for signs of identity theft or fraud, and consider placing fraud alerts or credit freezes if you received breach notification. Request copies of what student data is being collected and stored by educational technology vendors used by your school.

Summary generated from verified sources and reviewed before publication. How we summarize.

Sources

Related Events

The California Supreme Court ruled that plaintiffs can sue over medical record... - Industry | PrivacyWire