On October 26, 2026, a federal judge denied ed-tech provider PowerSchool’s motion for partial judgment, keeping a California medical-privacy claim alive in In re PowerSchool Holdings, Inc. & PowerSchool Group, LLC Customer Security Breach Litig., No. 25-md-03149-AJB-MSB, slip op. at 12 (S.D. Cal. Oct. 26, 2026).

The case stems from a 2024 data breach that allegedly affected nearly 50 million K–12 students and teachers. PowerSchool provides software and data-management services to school districts. The plaintiffs allege that the company-maintained student medical information, including diagnoses, medications, and allergies, and made it available to school personnel and health-care providers. The court did not decide whether that handling violated the law. Here, it only decided whether the plaintiffs’ allegations were enough for the claim to continue.

You may wonder why an ed-tech company is facing a health-care privacy claim. Under California’s Confidentiality of Medical Information Act (CMIA), whether the law applies can depend on what a company does with medical information, not just the industry it serves. The CMIA generally bars covered entities from disclosing a patient’s medical information without authorization. To proceed, plaintiffs must plausibly allege that PowerSchool falls within a covered category, such as a health-care provider or contractor. The CMIA’s definition of a health-care provider can include a business that maintains medical information to make it available to individuals or providers for managing health information or for diagnosis and treatment.

PowerSchool argued that a recent California Supreme Court decision involving another education-technology company foreclosed the claim. The judge disagreed because that case involved allegations that student data was used for educational screening, while these plaintiffs allege that PowerSchool maintained and shared medical information for health-care purposes. According to the judge, that was enough for the CMIA-provider theory to proceed. A school-software company’s role can extend beyond education. When a platform handles student medical records to support care, it might find itself in the CMIA’s provider lane, too