Relating to class action certification for actions brought against certain health care entities for disclosure of health care information as a result of a cyber attack.
Impact
The passage of SB55 would significantly alter the legal landscape for health care entities by imposing restrictions on collective legal actions that patients might initiate in response to data breaches. By preventing class certification, the bill effectively removes a potential avenue for individuals to seek collective redress when affected by a cyber incident, which could discourage accountability among health care providers for data security lapses. This may lead to fewer penalties for entities that fail to protect sensitive information.
Summary
SB55 aims to amend the Health and Safety Code to prohibit the certification of class actions against health care entities regarding the disclosure of protected health information resulting from a cyber attack. Specifically, it adds Section 181.007 which states that a court may not certify a class action for damages stemming from such disclosures. The intent of this bill is to provide health care entities with greater protections in the event of a cyber incident that compromises patient data.
Contention
Notable points of contention surrounding SB55 include concerns from advocacy groups about patient privacy and the rights of individuals to come together in a class action in the face of widespread harm caused by data breaches. Critics argue that this bill skews the balance of accountability in favor of health care entities at the expense of protecting patients’ rights to pursue claims collectively. Supporters believe that the legislation is necessary to prevent the misuse of class action suits for what they consider could be lawful administrative or technical failures related to cyber security, thus protecting health care providers amid increasing technological vulnerabilities.