On Sept. 4, 2012, plaintiff Norma Lozano, a medical assistant for the University of California at Los Angeles who also received healthcare through the university, learned that an assistant in the office of a physician affiliated with, but not employed by the University of California, Los Angeles Health System, accessed her medical records. The assistant then texted photos to others, including Lozano’s former boyfriend. About a month after the breach of her records, Lozano received a letter from UCLA confirming that Dr. John Edwards, a non-UCLA physician who had authorized access as an affiliate, had shared his user identification and password with his office staff, which was how the assistant was able to view Lozano’s records. The assistant later married Lozano’s former boyfriend. Lozano sued The Regents of the University of California, Edwards, and several individuals. The case only continued against The Regents, as Edwards settled with Lozano prior to trial and the other individuals were never served. Lozano’s counsel contended that UCLA violated California’s Confidentiality of Medical Information Act. After Lozano’s records were breached, the university informed Lozano that her medical information would receive a second level of security, which requires users of UCLA’s digital system to enter their password a second time and submit a reason for viewing the requested records. However, counsel argued that Lozano and other patients within the system should have already had a second layer of protection. Defense counsel contended that Edwards violated university policy, which Edwards had agreed to follow, and that the assistant breached Lozano’s privacy, not the university. The defense’s experts and senior employees testified that UCLA’s security measures were consistent with the practice at other similar medical centers around the country and that test security measures were reasonable in light of patient safety and patient care objectives., Lozano claimed the violation of her privacy left her depressed and filled with anxiety. Thus, she sought recovery of emotional-distress damages.
