J.M. v. Illuminate Education, Inc.

Summary

The court held that J.M. failed to state claims under either the Confidentiality of Medical Information Act or the Customer Records Act. Illuminate was not adequately alleged to be a statutory provider of health care, and J.M. was not adequately alleged to be Illuminate’s customer. The court nevertheless rejected an actual-viewing requirement under the CMIA, holding that confidentiality may be breached when medical information is exposed to a significant risk of unauthorized access or use.