Sutter Health v. Superior Court

The Confidentiality of Medical Information Act, which we refer to in this opinion as the Confidentiality Act, protects the confidentiality of patients’ medical information. (Civ. Code, § 56 et seq.; all remaining unspecified code citations are to the Civil Code.) Among other remedies, the Confidentiality Act provides for an award of $1,000 in nominal damages to a patient if the health care provider negligently releases medical information or records in violation of the Confidentiality Act. (§ 56.36, subd. (b)(1).)

In this case, a thief stole a health care provider’s computer containing the medical records of about four million patients. The plaintiffs filed an action under the Confidentiality Act, seeking to represent, in a class action, all of the patients whose records were stolen, with a potential award of about $4 billion against the health care provider. The health care provider demurred to the complaint and moved to strike the class allegations, but the trial court overruled the demurrer and denied the motion to strike. On the petition of the health care provider, we issued an alternative writ of mandate to review the trial court’s rulings.

We conclude that the…