District of Arizona Clarifies Causes of Action Available for Breach of Health Data

The District of Arizona has clarified the kinds of legal claims that can still proceed after a breach of health data, noting that traditional tort and contract theories are hard to sustain, but consumer-fraud statutes can keep a case alive. In the case Johnson v. Yuma Regional Medical Center, fourteen patients sued the hospital after a ransomware incident exposed the data of roughly 700,000 individuals. In a 16-page opinion, Judge Susan M.

Brnovich dismissed four of the five causes of action—negligence, breach of implied contract, unjust enrichment, and breach of fiduciary duty—while allowing a single claim under the Arizona Consumer Fraud Act to proceed. The analysis and commentary on the decision were provided by Nick Palmieri of Baker Botts, who writes that consumer-fraud statutes can play a crucial role for healthcare providers facing cyber incidents. According to JDSupra, readers can read more about the case and the court’s opinion. 3 September 2025.