California Court Allows Student Medical Data Privacy Claim Against PowerSchool to Proceed

On October 26, 2026, the U.S. District Court for the Southern District of California denied PowerSchool’s motion for partial judgment in a case involving student medical information. The decision allows plaintiffs’ claim under the California Confidentiality of Medical Information Act (CMIA) to proceed. Plaintiffs allege that PowerSchool maintained and shared student medical information for health-care purposes. The court did not decide whether PowerSchool violated the statute, and the allegations should not be treated as an established finding of misconduct.

The dispute raises a procurement-relevant question for education agencies and their technology providers: how should student health information be treated when it is handled by a software platform used in a school setting? The CMIA claim turns on allegations about the information’s handling and purpose. The ruling does not establish that education software providers are health-care providers, nor does it settle the legal status of the information or the company’s conduct. It does, however, allow the plaintiffs to continue pursuing that theory, keeping the issue relevant to organizations that buy, supply, or administer systems handling student health records.

For school districts and other public education buyers, the case underscores the importance of understanding actual data flows—not just the broad function of a platform. Procurement and privacy reviews can examine what health information enters a system, which parties can access it, whether and how it is shared, and what authorizations govern those activities. Contract terms should clearly address the parties’ responsibilities for handling and sharing student medical information, as well as the controls and processes expected of the vendor. These reviews can help buyers identify gaps before deployment or renewal and establish a clearer record of intended data use.

The immediate procurement implication is risk management rather than a change in legal obligations established by this ruling. Buyers should distinguish a procedural decision from a judgment on the merits when assessing PowerSchool or other providers, and avoid treating the case as proof that a vendor has violated the law. At the same time, contractors serving education customers should be prepared to explain their data practices and contractual allocation of responsibilities. The case may also prompt agencies to revisit whether existing requirements adequately describe health-data handling, access controls, permitted sharing, and authorizations across the software lifecycle.

• Court action: On October 26, 2026, the U.S. District Court for the Southern District of California denied PowerSchool’s motion for partial judgment.
• Claim proceeding: Plaintiffs’ claim under the California Confidentiality of Medical Information Act (CMIA) may continue.
• Allegation: Plaintiffs allege PowerSchool maintained and shared student medical information for health-care purposes.
• No liability finding: The court did not determine whether PowerSchool violated the CMIA; the ruling is procedural.
• Buyer review: School districts should map data flows and assess access controls, authorizations, and sharing involving student health records.
• Contract diligence: Education-software agreements should clearly address each party’s responsibilities for handling and sharing student medical information.
• Vendor assessment: Procurement teams should distinguish allegations from established facts when evaluating providers and documenting risk.
• Contractor readiness: Education technology suppliers should be able to describe data practices and the safeguards and responsibilities reflected in customer arrangements.