An Allegheny County Court of Common Pleas judge has dismissed a class action suit against UPMC over a data breach, ruling Pennsylvania law does not recognize a civil cause of action against companies for failing to keep confidential information secure.

In Dittman v. UPMC, the more than 62,000 plaintiffs had contended the hospital was negligent for failing to implement and monitor an adequate security system, and for failing to properly detect a data security breach. But Judge R. Stanton Wettick Jr. rejected that argument, and said any duty of care for a negligence action would need to be created by the state General Assembly.

“The legislature is aware of and has considered the issues that plaintiffs want this court to consider. As of this date, the only legislation which the General Assembly has chosen to enact requires entities that suffer a breach of their security systems to provide notification,” Wettick said. “Furthermore, the legislature gives the Office of Attorney General exclusive authority to bring an action for violation of the notification requirement (i.e., no private actions are permitted).”