California court rules lawsuit over breach of HIV patient records can move forward

A California court has ruled that a class-action lawsuit filed against a program after a breach exposed the medical records of 93 people living with HIV can move forward.

Earlier this month, the Superior Court of California in San Francisco denied a motion made by A.J. Boggs & Company to dismiss the lawsuit—meaning the class-action lawsuit will continue. A.J. Boggs & Company previously served as a vendor to administer California’s AIDS Drug Assistance Program (ADAP) online enrollment system. The program helps people living with HIV, who can’t receive Medicaid, pay for “life-saving” medications.

In Feb. 2017, the California Department of Public Health discovered that unknown individuals accessed the ADAP system and downloaded the private health information—including their HIV status—of 93 people. The state notified the individuals of the data breach and canceled its contract with the company.

“We are very pleased California’s Superior Court rejected A.J. Boggs & Company’s attempt to have this case dismissed,” Jamie Gliksberg, leading attorney for the case, said in a statement. “A.J. Boggs & Company must be held responsible for failing to secure the private and confidential HIV-related medical information of Californians with HIV who rely on the ADAP for life-saving medication.”

The class-action complaint—filed in April 2018—claims A.J. Boggs & Company violated California’s medical privacy laws, including the California AIDS Public Health Records Confidential Act and the California of Medical Information Act.