WENATCHEE — The state Court of Appeals on Thursday reversed a dismissal issued by Chelan County Superior Court over the consequences of a health district data breach.
Sensitive information from more than 100,000 people were exposed in a data breach involving the Chelan-Douglas Health District, reported to the state Attorney General Office’s in March 2022.
Sarah Nunley, a Chelan County resident, and Michelle Slater, a Douglas County resident, were among the people affected by the 2022 data breach. The two filed a class action complaint in June 2022 alleging the health district failed to protect the sensitive information they possessed.
Newsletter embed
The lawsuit in Superior Court was dismissed after the health district filed motions to dismiss based its belief that it did not owe the plaintiffs a “duty of care since any injury was caused by the criminal acts of third parties,” according to the court of appeals decision.
The health district also argued that the plaintiffs had not identified an actual injury that could be recognized by a court. Judge Kristen Ferrera dismissed the case on Feb. 23, 2023.
The Court of Appeals did not agree that the health district’s arguments were grounds for dismissal.
“We hold that companies that collect and store personal identifiable information (PII) and personal health information (PHI) have a duty to use reasonable care in collecting and storing the information,” Judge Tracy Staab wrote in her decision
The higher court also ruled that the alleged damages “are sufficient to assert a current loss, and it is possible that the plaintiffs will be able to prove these damages.”
Nunley said as part of the lawsuit that they had experienced an “substantial uptick in the number and frequency of spam telephone calls related to medical services” and “multiple telephone calls from a person impersonating a representative from (the health district),” according to court documents.
Nunley also said that a business license was opened in her name and that a credit monitoring service had detected two instances of her Social Security number appearing on the dark web.
With this reversal, the case is remanded to Superior Court to proceed as normal.
