Top Appellate Reversals: Eisenhower Medical Center v. The Superior Court of Riverside County

An unencrypted computer containing the personal identifying information of more than 500,000 patients was stolen from Eisenhower Medical Center in Rancho Mirage. The hospital was hit with a putative class action alleging privacy violations under the state Confidentiality of Medical Information Act and Customer Records Act, with a potential $500 million in damages at stake.

Attorneys for Eisenhower Medical Center focused on what they thought was the critical issue: The stolen patient information wasn't covered under the medical information statute, because it wasn't medical information.

It contained only demographic information - including names, ages and birthdays - but lacked medical history or treatment information, said Michael R. Matthias, a Baker & Hostetler LLP partner who represented Eisenhower.

"We moved simply on that issue to focus the court's attention, and also we thought it was a clean issue for an appellate court," Matthias said. Â

It ended up at the 4th District Court of Appeal, where Eisenhower's attorneys sought writ review after the trial court denied their summary adjudication motion. Eisenhower Medical Center v. The Superior Court of Riverside County 226 Cal.App.4th 430 (Cal. App. 4th Dist., May 21, 2014).

In a precedent-setting opinion, the appeals court in May cleared Eisenhower of liability under the medical privacy statute by finding that a data breach "must include more than individually identifiable information but must also include information relating to medical history, mental or physical condition, or treatment of the individual."

The appeals court's narrowed definition of medical information under the Confidentiality of Medical Information Act helps further clarify against what it is intended to protect, Matthias said.

The California Supreme Court denied review of the case, and in December, both sides agreed to dismiss the remaining claims with prejudice.

Despite the reversal, plaintiff's attorney Alan Harris said it was a successful case because "the hospital made substantial changes in the way in which they safeguard patient information." Among those changes, the acute care facility now encrypts data, he said.

- Kylie Reynolds