A Cautionary Tale Involving a Business, a Privacy Policy, and an Email

Hinshaw Privacy & Cyber Bytes - Insights on Compliance, Best Practices, and Trends

Accidents happen, but so can negligence. When you combine negligence with a violation of one or more statutes and a constitutionally guaranteed right to privacy, the consequences can and should be dire. That is what the unidentified plaintiff in Jane Doe v. Lane Fertility Institute for Education and Research Inc., et al. is claiming anyway.

In the case—which is currently pending in the Superior Court of California, Marin County—defendant is a business subject to the requirements outlined in the federal Fertility Clinic Success Rate Act of 1992 (FCSR). To keep its certification under the FCSR, defendant is required to report specific data, such as a patient's medical history, a description of the fertility treatments and procedures attempted, and any information about resulting pregnancies and births.

In 2018, plaintiff engaged defendant, seeking fertility-related medical services. The privacy policy provided to plaintiff stated that defendant would contact her only through the means she designated. Plaintiff provided a private email address as her preferred method of contact, but would later communicate with defendant via her personal work email.

In late 2019, defendant contacted plaintiff by way of her personal work email address and sought information from her so that it could comply with its reporting obligations. Plaintiff was on maternity leave, so defendant received an automated message, which included a general email address to contact for inquiries. Although the automated message alone should have been a red flag, defendant, nevertheless, sent an email containing plaintiff's personal health information to the general email address. Nine of plaintiff's co-workers—who had no knowledge of the procedures defendant had performed—received the email. Distressed by the disclosure of her private medical information, plaintiff filed a complaint against defendant.

While the outcome of this case remains to be seen, it is still instructive for businesses that communicate personal and private information. Some key takeaways we identified are:

  • When communicating personal information electronically, know and understand who all the recipients are.
  • Businesses should follow their privacy policies. Deviations from the policy may result in legal action and ultimately subject a business to both liability and reputational damages.
  • Businesses should provide employees with training on both the handling of personal information and the terms of their own privacy policy.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Hinshaw Privacy & Cyber Bytes - Insights on Compliance, Best Practices, and Trends | Attorney Advertising

Written by:


Hinshaw Privacy & Cyber Bytes - Insights on Compliance, Best Practices, and Trends on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.