Polsinelli recently secured a significant win for firm client Delta County Memorial Hospital District (Delta Health), obtaining dismissal of a putative data breach class action in the District Court for Delta County, Colorado.

In granting Delta Health’s motion to dismiss, the court held that Delta Health was immune from liability under the Colorado Governmental Immunity Act (CGIA). In a matter of first impression, the court agreed that protecting patient records from a cyberattack is ancillary to a public hospital’s primary purpose of providing health care services to the community. As a result, the CGIA’s waiver of immunity for injuries arising from the operation of a public hospital did not apply, and the court dismissed the amended complaint in its entirety for lack of subject matter jurisdiction.

The plaintiffs, former patients of Delta Health, filed the action following a May 2024 cyberattack that allegedly exposed personal and financial information. Plaintiffs asserted claims including negligence, breach of implied contract, breach of fiduciary duty and unjust enrichment. The court found that all claims either sounded in tort or could sound in tort and were within scope of the CGIA, and the Court determined that no discovery or evidentiary hearing was necessary because there were no disputed jurisdictional facts. Without subject matter jurisdiction, the case could not proceed.

The Polsinelli team was led by Shareholder Starr Turner Drum and included Counsel Nicholas M. Cassidy as well as Associates Xeris E. Gregory and Mary K. Longenbaker.