Ninth Circuit Holds Health Data Disclosure Is Sufficient for Article III Standing

Black v. IEC Group, Inc., No. 25-5952 (9th Cir. Oct. 9, 2026)

To bring a lawsuit in federal court, a plaintiff must have “standing” under Article III of the U.S. Constitution, which requires a concrete “injury in fact.” In data breach cases, defendants often seek early dismissal by arguing that plaintiffs who have suffered no identity theft or out-of-pocket loss have no injury sufficient for standing.

On October 9, 2026, the Ninth Circuit issued its opinion in Black v. IEC Group, Inc., that significantly narrows that defense. The court held that plaintiffs whose confidential health information was disclosed without authorization have Article III standing to sue, even without showing financial loss or a substantial risk of future harm. The Ninth Circuit reversed the District of Idaho, which had dismissed the putative class action for lack of subject matter jurisdiction.

Background

The plaintiffs receive health insurance through a plan administered by IEC Group, which does business as AmeriBen. In August 2023, AmeriBen told plaintiffs that an employee emailed a spreadsheet containing their information to one or more plan members. The spreadsheet included names, provider names, claim numbers, dates of service, and amounts billed or paid. The plaintiffs brought a class action asserting state law claims. They alleged that AmeriBen had promised, including through its Privacy Policy, to keep their information confidential.

The district court granted dismissal under Rule 12(b)(1). It reasoned that a disclosure of personal information is a concrete injury only if it shows an “imminent and substantial injury,” and it found that the plaintiffs had not shown a substantial likelihood of future harm.

The Ninth Circuit’s Reasoning

Writing for the panel, Judge Tung applied the “historical analogue” test from U.S. Supreme Court precedent. Under that test, an intangible harm can satisfy Article III if it has a close relationship to a harm that courts have historically recognized. The court found that analogue in “breach of confidence,” an equitable action with deep English and American roots. In the court’s words, “a trust betrayed is the harm.” The panel added that breach of contract supports the same analogy because common law contract actions were available without any monetary or physical injury.

The court also pointed to the Health Insurance Portability and Accountability Act (HIPAA). HIPAA does not give individuals a private right to sue, but it does prohibit disclosure of this type of health information, which the court viewed as a congressional judgment that the information deserves protection. The court explained that even data that seems mundane, such as provider names and dates of service, can reveal a person’s most private health concerns.

Significance for Class Actions

By lowering the federal standing threshold, Black is likely to shape how class action cases are filed, litigated and settled. Key implications include:

• No future harm showing is needed. The plaintiffs’ injury was the disclosure itself, so they did not have to allege identity theft or an imminent risk of misuse.
• Standing may be decided for every claim at once. Standing is assessed claim by claim, but when every count rests on the same injury, the inquiry “yields a single answer.” In practice, this means plaintiffs who plead a single disclosure-based injury may be able to carry an entire bundle of contract, tort and statutory claims past the pleading stage together.
• Privacy policies matter. The court relied heavily on the defendant’s promises of confidentiality. Because a privacy policy typically makes the same promise to every customer, it can supply a common, class-wide basis for standing. Companies should recognize that their own published privacy commitments may become a central exhibit in litigation against them.
• Forum shopping risk. Because Black binds only federal courts within the Ninth Circuit, plaintiffs’ firms now have a strong incentive to file privacy class actions in those district courts where cases are more likely to survive a motion to dismiss. Defendants, in turn, may seek to transfer cases or to enforce forum selection and arbitration clauses.
• The court left a second theory open. The panel did not decide whether “disclosure of private information” alone would independently support standing.

Takeaways

For businesses that handle sensitive personal data, Black means that a single misdirected email or spreadsheet can support a federal class action in the Ninth Circuit, even without evidence that anyone misused the information. Businesses sued in the Ninth Circuit should expect early standing challenges to be harder to win. Defense strategy will likely shift toward the merits, class certification and damages.