What Are Your Rights After a Medical Data Breach in California?

Last updated June 30, 2026 · Reviewed by Michael Nourmand

Medical records hold some of the most sensitive information a person has, and California law treats a breach of that data more seriously than most. When a health care provider, an insurer, or one of their vendors exposes confidential medical information, the state’s Confidentiality of Medical Information Act gives the affected patient a direct remedy, separate from the general data breach statutes.

Under the Confidentiality of Medical Information Act, a patient whose medical information is negligently released can recover $1,000 in nominal damages for each violation, without proving any financial loss. That remedy sits alongside California’s broader breach-notification and consumer-privacy laws, so one exposure of health data can support more than a single claim. The Nourmand Law Firm represents California patients and workers whose private information is exposed, and its California data breach practice covers how these claims fit together.

What the Confidentiality of Medical Information Act Protects

The Confidentiality of Medical Information Act is California’s medical-privacy statute, codified at Cal. Civ. Code § 56 and the sections that follow, which restricts how a provider or its contractors may disclose a patient’s medical information and lets a patient sue when that information is released without authorization. It reaches individually identifiable details about a person’s medical history, mental or physical condition, and treatment.

The law binds more than hospitals and doctors. Health care service plans, laboratories, billing companies, and other contractors that receive medical information are covered too, which matters because many breaches happen at a vendor rather than at the provider itself. A patient whose records were exposed through a third party still has rights under the statute.

What Can You Recover After a Medical Data Breach?

Under Cal. Civ. Code § 56.36, a patient whose medical information is negligently released may recover nominal damages of $1,000 for each violation, even without proof of an actual loss. Where the breach caused real harm, actual damages are recoverable on top of that figure.

Health data breaches often trigger California’s general laws as well. Medical and health insurance information are covered data elements under the breach-notification statute, § 1798.82, and the consumer private right of action under Cal. Civ. Code § 1798.150 allows statutory damages of $100 to $750 per incident when unencrypted personal information is exposed through weak security. One breach can therefore carry overlapping remedies. The Nourmand Law Firm has recovered between $1.35 million and $7.25 million in past class action cases, and it brings that experience to breaches affecting large groups of patients on a no recovery, no fee basis.

Who Can Be Held Responsible for a Medical Data Breach?

Responsibility turns on who held the data and how it was handled, not simply on who was hacked. A hospital or medical practice that failed to secure its systems can be liable, and so can a health plan, a laboratory, or a billing and collections vendor that received the records under contract. The Confidentiality of Medical Information Act extends to these contractors precisely so that outsourcing sensitive data does not outsource the duty to protect it.

The standard is negligence. A patient does not have to show that a business intended to expose the records, only that it failed to use reasonable care in safeguarding them. That is why the security practices a provider or vendor had in place, and whether they matched the sensitivity of the information, sit at the center of these cases.

What Should You Do if Your Medical Records Were Exposed?

Act quickly, because the same steps that protect your identity also preserve a potential claim. Keep the breach notice and any letter describing what was exposed, place a security freeze with the three credit bureaus, and review your medical and insurance statements for care or charges you did not authorize, which can be a sign of medical identity theft. The firm’s guide on what to do after a data breach letter walks through the full sequence.

Watch for the enrollment terms in any credit monitoring the business offers. Some of those offers ask a patient to accept arbitration or release claims in exchange for the service, and signing up should not require giving up the right to sue over the breach.

Common Questions About Medical Data Breaches in California

Does HIPAA Let Me Sue After a Medical Data Breach?

No. The federal HIPAA law sets privacy standards but does not give an individual a private right to sue. In California, the path to a personal remedy runs through state law, chiefly the Confidentiality of Medical Information Act and, where personal information beyond medical records was exposed, Cal. Civ. Code § 1798.150.

How Much Is a Medical Data Breach Claim Worth in California?

It depends on what was exposed and how many people were affected. The Confidentiality of Medical Information Act allows nominal damages of $1,000 per violation under Cal. Civ. Code § 56.36 with no proof of loss, and statutory damages of $100 to $750 per incident may also apply under § 1798.150. Actual losses are recoverable on top.

Is a Breach at My Doctor’s Billing Company Covered?

Yes. Contractors that receive medical information, including billing and collections companies, laboratories, and health plans, are bound by the Confidentiality of Medical Information Act. A patient whose records were exposed at one of those vendors has the same rights as if the breach happened at the provider’s own office.

Contact The Nourmand Law Firm About a Medical Data Breach

If your medical records were exposed in a California breach, The Nourmand Law Firm can review what happened and explain your options at no charge. The firm represents the patients and workers whose information was compromised, never the companies that lost it, and works in English and Spanish. Contact The Nourmand Law Firm at 800-700-WAGE (9243) or through its contact page to have your situation reviewed on a no recovery, no fee basis.