Keeping Coverage Online: Fourth Circuit Confirms Internet Data Breach Claim Triggers Commercial General Liability Policies
In a clear rejection of insurers’ attempts to artificially narrow the broad coverage provided by commercial general liability (“CGL”) policies, the United States Court of Appeals for the Fourth Circuit recently held that an insurer had a duty to defend its policyholder in a case involving the inadvertent posting of patients’ private information online. The court’s ruling in Travelers Indemnity Company of America v. Portal Healthcare Solutions, L.L.C., No. 14-1944 (4th Cir. Apr. 11, 2016) (unpublished),[1] is a useful reminder to policyholders of three important points. First, insurance provisions regarding the “publication” of certain materials are to be construed broadly. Second, policyholders should not assume that their CGL policies necessarily exclude coverage for all forms of data breaches. Finally, policyholders should consider obtaining specialized “cyber” insurance with express coverage for data breach claims.
The Fourth Circuit’s Portal Healthcare Ruling
Portal Healthcare Solutions, L.L.C. (“Portal Healthcare”), a business specializing in electronic maintenance of medical records, was sued on April 18, 2013, in a class-action lawsuit alleging that it posted patients’ records on the internet in a manner that allowed the records to be accessed with a Google search of the patients’ names. Travelers Indemnity Company of America (“Travelers”) had issued to Portal Healthcare two CGL policies, with policy periods from January 31, 2012 to January 31, 2014, each of which provided coverage for claims based on injury arising from “electronic publication” of certain materials relating to “a person’s private life.”[2] After filing a declaratory judgment lawsuit against Portal Healthcare, Travelers argued before the federal district court that it had no duty to defend, because (1) the “publication” element of its coverage was limited to intentional publication, as opposed to inadvertent disclosure, and (2) no third party was alleged to have actually viewed the patients’ medical records online, and according to Travelers the mere availability of private information to third parties did not constitute “publication.”[3] The district court rejected Travelers’ arguments, holding that the class action was potentially within the CGL coverage, and therefore Travelers had a duty to defend Portal Healthcare.[4] The Fourth Circuit, applying Virginia law, affirmed the district court’s judgment.
Lessons From Portal Healthcare
The Portal Healthcare case suggests three important lessons for policyholders who may face claims relating to the disclosure of confidential or personal information.
- Coverage for the “Publication” of Personal Information Should Be Construed Broadly.
The Fourth Circuit correctly observed that Travelers’ arguments on the “publication” issue amounted to “efforts to parse alternative dictionary definitions” in an attempt to “absolve” itself of its duty to defend.[5] Contrary to the insurer’s argument, “publication” required simply that the personal information be placed before the public, regardless whether the insured intended to do so or whether any member of the public actually read the information. As the district court explained: “an unintentional publication is still a publication.”[6] Further, because “publication” occurs when information is placed before the public, whether or not a member of the public was alleged to have actually accessed the personal information was not necessary to find a “publication.”[7]
The Fourth Circuit’s affirmation of the district court’s reasoning suggests that recent decisions holding that the “publication” element, as expressed in the CGL grant of coverage, was not satisfied are properly viewed as limited to their unique facts, rather than signaling a broad and artificial narrowing of the CGL coverage for data breach claims.[8] Accordingly, policyholders should be skeptical of coverage defenses based on the contention that placing information on the internet does not constitute a covered “publication.” - Not All CGL Policies Contain Data Breach Exclusions.
In recent years, the insurance industry has introduced policy exclusions or other endorsements that purport to limit or eliminate CGL coverage for data breaches. For example, in 2013, Insurance Services Office Inc. (“ISO”) introduced an exclusion providing that coverage is excluded for injury “arising out of any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of non public information.”[9]
Although such exclusions may bar coverage in certain factual circumstances, policyholders should not assume, without carefully reviewing the terms of their CGL policies, that those policies actually bar coverage for the data breach claim that is asserted. For one thing, the policies at issue in Portal Healthcare, the latest of which expired in 2014, apparently did not include any such exclusions. Further, the applicability of any exclusion to a particular claim depends on many factors, including the precise wording of the exclusion and the actual and alleged facts of the underlying claim.
- Specialized “Cyber” Insurance May Provide Valuable Coverage.
While Portal Healthcare demonstrates the potential for coverage of certain data breach claims under CGL policies, policyholders may find it prudent to consider seeking to obtain specialized “cyber” insurance. “Cyber” policies are drafted to expressly provide coverage for data breaches and associated expenses. These policies may also cover many other types of losses related to online security and data protection. Selecting appropriate “cyber” insurance can present a challenge, as the policy wording and scope of coverage vary significantly from one “cyber” insurance policy to another. Policyholders can benefit from the involvement of experienced coverage counsel in selecting a “cyber” insurance product, preparing applications for “cyber” insurance, and reviewing and negotiating policy terms.
Conclusion
Portal Healthcare serves as an important reminder that a corporate policyholder’s CGL insurance may be a potential source of coverage for data breach claims. When properly construed, the coverage afforded by CGL policies is very broad, and a careful review of the policy terms is required in order to assess whether coverage for a specific data breach claim may be within or excluded from CGL coverage. As an additional source of potential coverage for data breaches and other “cyber” claims, policyholders may wish to consider obtaining specialized “cyber” insurance.
Notes:
[1] Cited herein as “Portal Healthcare II.”
[2] Specifically, the policy in effect from January 31, 2012 to January 31, 2013 covered “electronic publication of material that . . . gives unreasonable publicity to a person’s private life.” The policy in effect from January 31, 2013 to January 31, 2014 covered “electronic publication of material that . . . discloses information about a person’s private life.” Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, LLC, 35 F. Supp. 3d 765, 767 (E.D. Va. 2014) (“Portal Healthcare I”).
[3] Id. at 770-71.
[4] Id. at 771-72.
[5] Portal Healthcare II, at *7-8.
[6] Portal Healthcare I, 35 F. Supp. 3d at 770.
[7] The district court explained: “By Travelers’ logic, a book that is bound and placed on the shelves of Barnes & Noble is not ‘published’ until a customer takes the book off the shelf and reads it. Travelers’ understanding of the term ‘publication’ does not comport with the term’s plain meaning . . . .” Id. at 771.
[8] See, e.g., Recall Total Info. Mgmt., Inc. v. Fed. Ins. Co., 115 A.3d 458 (Conn. 2015) (no “publication” where computer tapes fell out of van, were taken by an unknown person, and were never recovered); Creative Hospitality Ventures, Inc. v. U.S. Liab. Ins. Co., 444 Fed. App’x 370 (11th Cir. Sept. 30, 2011) (no “publication” where underlying plaintiffs were given receipts bearing their own personal credit card information); Whole Enchilada, Inc. v. Travelers Prop. Cas. Co. of Am., 581 F. Supp. 2d 677 (W.D. Pa. 2008) (same).
[9] Form CG 21 07 05 14 (2013).
This publication/newsletter is for informational purposes and does not contain or convey legal advice. The information herein should not be used or relied upon in regard to any particular facts or circumstances without first consulting a lawyer. Any views expressed herein are those of the author(s) and not necessarily those of the law firm's clients.
