A Cautionary Tale Involving a Business, a Privacy Policy, and an Email

August 12, 2021
Hinshaw Privacy & Cyber Bytes

Accidents happen, but so can negligence. When you combine negligence with a violation of one or more statutes and a constitutionally guaranteed right to privacy, the consequences can and should be dire. That is what the unidentified plaintiff in Jane Doe v. Lane Fertility Institute for Education and Research Inc., et al. is claiming anyway.

In the case—which is currently pending in the Superior Court of California, Marin County—defendant is a business subject to the requirements outlined in the federal Fertility Clinic Success Rate Act of 1992 (FCSR). To keep its certification under the FCSR, defendant is required to report specific data, such as a patient's medical history, a description of the fertility treatments and procedures attempted, and any information about resulting pregnancies and births.

In 2018, plaintiff engaged defendant, seeking fertility-related medical services. The privacy policy provided to plaintiff stated that defendant would contact her only through the means she designated. Plaintiff provided a private email address as her preferred method of contact, but would later communicate with defendant via her personal work email.

In late 2019, defendant contacted plaintiff by way of her personal work email address and sought information from her so that it could comply with its reporting obligations. Plaintiff was on maternity leave, so defendant received an automated message, which included a general email address to contact for inquiries. Although the automated message alone should have been a red flag, defendant, nevertheless, sent an email containing plaintiff's personal health information to the general email address. Nine of plaintiff's co-workers—who had no knowledge of the procedures defendant had performed—received the email. Distressed by the disclosure of her private medical information, plaintiff filed a complaint against defendant.

While the outcome of this case remains to be seen, it is still instructive for businesses that communicate personal and private information. Some key takeaways we identified are: