THE Supreme Court of California has ruled in J.M. v. Illuminate Education, Inc, reversing the Court of Appeal and holding that J.M. failed to state viable claims under the Confidentiality of Medical Information Act (CMIA) and the Customer Records Act (CRA). The decision, announced on 16 May 2026, remands the case to the Court of Appeal for further proceedings consistent with the opinion, including the possibility of amending the complaint.
The court found that Illuminate was not a “provider of health care” under the CMIA, and rejected the allegation of a CRA violation for lack of evidence that J.M. was ever a “customer” of Illuminate. However, the opinion also notes that it lowers the bar for what is covered by the CMIA by stating that stolen information need not have been viewed to constitute a breach under the CMIA.
The ruling comes after a 2025 settlement of $5.1 million with a coalition of state attorneys general and a separate FTC action settled in 2025. The breach in question affected 1.7 million students in New York and 434,000 in California.