The West Virginia Supreme Court of Appeals recently held, In Tabata v. Charleston Area Medical Center, Inc., that patients whose medical information was accidentally published online by the medical provider had standing to sue.  Both federal and state courts are grappling with what constitutes sufficient injury to establish standing in data breach cases, and the question of whether future injury suffices to establish standing has split federal courts in such cases.  Although the West Virginia court held that the risk of future identity theft was insufficient to establish standing, the plaintiffs still had standing to sue because the defendants had allegedly breached the confidentiality of their medical information and had violated their right to privacy, which are legally-protected interests in the state.