The justices of the Pennsylvania Supreme Court have agreed to hear a case alleging the University of Pittsburgh Medical Center was liable for the theft of its employees' identities.

The court granted allowance of appeal in Dittman v. UPMC. In an apparent case of first impression, a divided three-judge Superior Court panel ruled Jan. 12 that UPMC could not be held liable in a suit brought by several employees who were victims of identity theft after their electronically stored employment information—including dates of birth, addresses and Social Security numbers—was stolen from the health care provider's servers. The decision affirmed the Allegheny County Court of Common Pleas, which had tossed the proposed class action suit that had alleged negligence and breach of implied contract.

The ruling surprised a number of cybersecurity lawyers, who said it appeared to create a nearly insurmountable hurdle for plaintiffs in Pennsylvania state court and was out of step with several other courts that have tackled similar issues.