Black v. IEC Group: Entrusted Health-Plan Information and Concrete Injury

Black v. IEC Group, Inc., No. 25-5952 (9th Cir. Oct. 9, 2026), addressed whether unauthorized disclosure of sensitive health-plan information alleged a concrete injury sufficient for federal Article III standing. The Ninth Circuit reversed dismissal and remanded. It did not award damages or decide that the administrator was liable on the pleaded state-law claims.

A plan-administration disclosure, not publication of a lawsuit

The plaintiffs received health insurance through a plan administered by IEC Group, doing business as AmeriBen. According to their allegations and the notification letters described in the opinion, an associate emailed a spreadsheet containing their information to one or more other plan members. The listed information included names, tracking and claim numbers, providers, service dates, and amounts billed or paid. The opinion describes allegations at the dismissal stage, not findings following a trial. Black, slip op. at 3–5.

The plaintiffs also alleged that the administrator expressly and impliedly promised confidentiality, including through its privacy policy, and that they entrusted their information in reliance on that promise. Those relationship-specific allegations mattered. This was not a holding that every unwanted use of any personal datum establishes a federal case.

The question was concrete harm at the courthouse threshold

The district court dismissed under Rule 12(b)(1), reasoning that the plaintiffs had not established an injury in fact. The Ninth Circuit reviewed that ruling de novo. At this pleading stage, the plaintiffs needed allegations that, if proven, would confer standing. Article III requires an injury in fact that is fairly traceable to the challenged conduct and likely to be redressed by the court. Standing is a jurisdictional threshold, separate from whether every element of a cause of action can ultimately be proved. Id. at 5–7.

For an intangible harm, the court examined whether the asserted injury closely resembled harm traditionally recognized in English or American courts. An exact historical duplicate is unnecessary, but identifying a modern privacy concern alone does not replace that inquiry. The panel focused on disclosure of sensitive information learned within a relationship of confidence.

Breach of confidence supplied the historical analogy

The opinion traces authorities recognizing judicial relief when someone entrusted with confidential information disclosed or used it contrary to that confidence. Its analysis did not depend on a showing that the information itself was property with a measurable market price. The alleged betrayal of the confidential relationship supplied the relevant harm. The plaintiffs’ allegations about contractual confidentiality promises reinforced that analogy. Id. at 7–15.

The panel did not resolve every possible theory of disclosure-based standing. In footnote 2, it expressly left open whether the separate historical tort of disclosure of private information provided another basis. Readers should not convert the decision into a universal rule about the publicity element of every privacy claim. The particular confidence-and-promise allegations did the work here.

HIPAA supported the sensitivity analysis; it did not create this lawsuit

The court also discussed Congress’s protection of individually identifiable health information through HIPAA. It expressly recognized that HIPAA does not provide a private cause of action. The case involved pleaded state-law theories; the statute’s protection helped confirm the nature of the asserted harm rather than supplying a newly recognized private HIPAA damages claim. Id. at 16–17.

Provider identities, treatment dates, and billing amounts may reveal sensitive health concerns even without a diagnosis printed in the same row. The panel therefore rejected treating the described information as harmless merely because some fields appeared administrative. That reasoning concerned the entrusted health information and pleaded disclosure before it.

What a participant’s records need to distinguish

For a worker or family member receiving a health-plan disclosure notice, a useful consultation file separates four questions: What information was involved; who held it and under what confidentiality undertaking; what the notice actually says happened; and what harm and relief are asserted. Keep the original notice, envelope or email metadata, relevant privacy policy, enrollment materials, and correspondence. Identify uncertainty as uncertainty rather than expanding a notice saying information may have been disclosed into a proven public release.

Preserve those materials securely. Do not repost a spreadsheet or circulate other participants’ information to investigate your own claim. The case does not authorize accessing an employer’s or administrator’s systems, and disclosure to counsel should use an appropriate confidential channel.

The reversal permitted further proceedings. It did not decide class certification, damages, the merits of each state-law theory, or every other possible defense. A benefits-denial appeal, an employment retaliation complaint, and a confidentiality claim may raise different rules; this standing opinion does not merge them. The firm’s employment practice page provides a route to discuss which relationship and records are actually involved.