The high court unanimously ruled that the lawsuit by attorney Robert Brown against now-retired debt collector Stewart Mortensen was permitted by California's Confidentiality of Medical Information Act.
"Individuals, as patients, have a substantial interest in the privacy of their medical information," wrote Justice Kathryn Werdegar.
The panel overturned a Court of Appeal ruling that said the lawsuit must be dismissed because the state law was preempted by the federal Fair Credit Reporting Act.
The decision, issued at the court's headquarters in San Francisco, sends the case back to Los Angeles Superior Court for a trial on Brown's lawsuit.
The case began with a dispute over whether Brown owed his dentist, Rolf Reinholds, $600 for a dental crown for which the dentist billed him in 2000. Brown claimed he never received the crown and refused to pay the bill.
The dentist then referred to the bill to Mortensen for collection and sent him Brown's dental chart as well as those of his two children. Brown claimed those charts contained 10 years of medical information and other confidential details such as Social Security numbers.
His lawsuit alleged that Mortensen then sent the information to the nation's three major credit reporting agencies in violation of the confidentiality law, despite repeated requests by Brown that he stop making the disclosures.
In today's decision, the court said the state law does not conflict with the federal credit law because the U.S. statute concerns disclosure of inaccurate information while the state measure bars unauthorized release of information.
The panel also said the privacy provisions of a second federal law, the Health Insurance Portability and Accountability Act, do not conflict because the wording of that law specifically encourages additional, more protective state measures.
"Congress in HIPAA ... authorized and encouraged further state regulation of such matters," Werdegar wrote.
Charles Messer, a lawyer for Mortensen, said his client is considering an appeal to the U.S. Supreme Court.
Brown hailed the ruling as a victory for consumers.
"The decision demonstrates a clear and positive statement that California law must be applied to protect medical privacy in this information age," Brown said.
The attorney said that in the future trial court proceedings, he will seek to make the case a class action on behalf of all Californians whose medical information was turned over to credit agencies and other third parties without their permission.
Brown said the class might be as many as 4 million people, because Mortensen testified in a deposition that he gave information about that number of people to third parties, according to Brown. Most of the people were in Southern California, Brown said.