Supreme Court Rules Against Clalit Over Medical Data Privacy Vulnerabilities
The Israeli Supreme Court ruled that Clalit Health Services compromised patient privacy by using only ID numbers for phone verification, prompting security upgrades and compensation awards.
The Israeli Supreme Court has ruled in a class action lawsuit against Clalit Health Services, addressing critical privacy vulnerabilities in the health fund's telephone customer service center. The legal proceedings highlighted risks associated with identification mechanisms that previously relied solely on a member's ID number.
Privacy Concerns Raised in Court
The case, brought forward by Nona Day against Clalit—Israel's largest health maintenance organization serving approximately 5.5 million members—centered on the ability to access personal and medical information simply by punching in an ID number. During the hearings, Supreme Court Justice Ofer Grosskopf illustrated the vulnerability by posing a hypothetical scenario involving public figures, emphasizing how easily one could discover upcoming medical appointments, physician identities, and clinic locations.
Clalit initially defended its system, arguing that the information provided was predominantly technical and non-sensitive, and emphasized the necessity of maintaining accessible phone services for elderly populations and those lacking digital literacy. However, following judicial pressure during the February 2026 hearings, Clalit implemented technological upgrades.
New Security Protocols and Settlement
Under the updated protocol, automated phone services are restricted to members calling from a mobile phone officially registered to their name and linked to their ID number in Clalit's databases. If a mismatch occurs, information is withheld. Additionally, the organization updated its digital privacy notices.
While the technological remediation satisfied the petitioner regarding the cessation of the breach, disputes remained regarding legal fees and compensation. The Supreme Court ultimately overturned a previous Central District Court ruling that had dismissed the lawsuit and ordered the petitioner to pay 25,000 shekels in costs.
The Supreme Court ruled that the class action was justified, noting that it yielded substantial public benefit by exposing a genuine privacy flaw and prompting institutional remediation.
In its final decision delivered on June 24, 2026, by Justices Yael Wilner, Ofer Grosskopf, and Ruth Ronnen, the Supreme Court ordered Clalit to pay the petitioner 25,000 shekels in compensation, 100,000 shekels in legal fees plus VAT, and to reimburse court fees, while formally dismissing the class action without prejudice to individual damage claims.
