The U.S. Supreme Court Tuesday rejected CareFirst's appeal to review a case involving a 2014 data breach, according to Bank Info Security.
The breach exposed nearly 1.1 million patient records, and in August 2017, a three-judge panel determined the risk of potential harm was substantial, allowing a class action lawsuit to advance. In November 2017, the insurer petitioned the Supreme Court to review that lower court's ruling.
In its appeal, CareFirst argued lower courts struggle figure out if data breach victims have a constitutional right to sue. Or, more specifically, with the threshold question of whether data breach victims meet the Article III requirement of a concrete or imminent injury.
Attorney Jonathan Nace of the law firm Nadel and Nace, which also represents plaintiffs in the case, told Bank Info Security he didn't believe the Court should be concerned with establishing a precedent related to data breaches.
"The fact is that data breaches are happening all the time. The D.C. Circuit's opinion and the Supreme Court's decision to deny cert simply indicate that our courts will permit citizens to hold corporations accountable when they fail to take reasonable precautions to protect our data," he told the publication. "When you consider all of the Americans who have had their data exposed, it is important that corporate America understands that if they do not take reasonable steps to protect data, they will be held responsible. "
The case, CareFirst v. Attitas, will be sent back the Washington court that dismissed CareFirst's request the case be thrown out.
More articles on legal & regulatory issues:
Medicaid managed care led to millions in compensation for one California couple: 5 things to know
New York college files lawsuit to vacate nurse living in dorm room for almost 40 years
Florida man charged for attacking paramedics en route to hospital