Phoenix Children’s Hospital Faces Privacy Lawsuit Over Inadvertent Release of Vaccine Exemption Information

An apparent email snafu has led to the filing of a putative class action against the Phoenix Children’s Hospital. The allegations stem from an email that was allegedly sent out to 368 people that outlined the protocols for employees with approved COVID-19 vaccine exemptions. The email set forth the protocols related to accommodations for such unvaccinated employees. The complaint, filed in Superior Court in Maricopa County, Arizona, sounds in two counts: invasion of privacy and negligent disclosure of medical information. The complaint presents itself as a state-law class action on behalf of all persons whose exemption status was allegedly disclosed by the hospital.

The complaint also alleges that the email disclosed private information about plaintiffs; i.e., “whether they applied for, and received, a medical or religious exemption to COVID vaccination.” According to the complaint, the list of affected employees was also shared on social media.

The hospital released a statement to the media explaining, in part, that “[i]n the process of communicating internal safety protocols related to [workplace] accommodations,  the employee distribution list for one email message was inadvertently visible, instead of blind carbon copying the recipients. Since learning of our administrative error, we immediately informed affected employees of the error, extended our sincere apologies and explained that efforts had been taken to avoid similar mistakes in the future.”