Q: Non- Disclosure of security breach

A: Based on the details provided, it seems that the legal case filed 1.5 years ago should have prompted the hospital to review the plaintiff's records and investigate whether a security breach occurred that did not comply with their internal policies. Here are a few key points to consider under California law:

1. California Civil Code Section 1798.82 requires businesses, including hospitals, to disclose any breach of the security of their systems to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

2. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

3. The filing of a legal case related to the potential security breach should have served as a clear indication for the hospital to conduct a thorough investigation into the plaintiff's records and their own data security practices.

4. Regardless of any demurrers (objections to the legal sufficiency of the complaint) or discovery objections raised by the hospital in the legal proceedings, the hospital still has an independent obligation under California law to investigate and disclose any security breach that may have occurred.

In conclusion, the legal case filed 1.5 years ago should have triggered the hospital to revisit the plaintiff's records and determine whether a security breach occurred that did not comply with their own policies and California law. The hospital's failure to do so may constitute a violation of the California Civil Code and could potentially strengthen the plaintiff's case against the hospital.