A recent Fourth Circuit case affirmed a Virginia district court ruling that insurer Travelers Indemnity Company of America had a duty to defend a class action brought against its insured, Portal Healthcare Solutions, LLC, under a cyber liability insurance policy providing coverage for the electronic publication of certain materials. Portal Healthcare provided “electronic storage and maintenance of certain medical records” as a service to its healthcare provider clients.
The class action suit alleged that Portal Healthcare negligently failed to provide services when a wrong security setting on a web access portal was selected, allowing internet search engines to scoop up not only the login page as a search result, but also the underlying sub-pages containing medical records.
Travelers argued that it had neither a duty to defend nor indemnify under the 2012 and 2013 policies acquired by Portal Healthcare. The 2012 policy included a “Web Xtend Liability Endorsement” applicable to coverage for “Personal Injury, Advertising Injury and Web Site Injury Liability.” The 2013 Policy contained a Commercial General Liability Coverage Form applicable to “Personal and Advertising Injury Liability.” The applicable definitions included:
- “Advertising injury” means injury, arising out of one or more of the following offenses: … electronic publication of material that … gives unreasonable publicity to a person’s private life
- “Personal injury” means injury, other than “bodily injury,” arising out of one or more of the following offenses: … electronic publication of material that … gives unreasonable publicity to a person’s private life
- “Web site injury” means injury, other than “personal injury” or “advertising injury” arising out of one or more of the following offenses: … electronic publication of material that … gives unreasonable publicity to a person’s private life …”
Travelers asserted that it owed a duty to defend Portal Healthcare only if the underlying class action complaint alleged “(1) injury arising out of the offense of “electronic publication of material that … gives unreasonable publicity to a person’s private life” (2012 Policy) or (2) injury caused by the offense of “electronic publication of material that … discloses information about a person’s private life” (2013 Policy).”
The Fourth Circuit, however, held that the Eastern District Court of Virginia correctly analyzed the matter under the “Eight Corners” rule, where the court must look first to the four corners of the contract (the insurance policy) and then the four corners of the complaint. The policy provided coverage for “publication” of electronic materials which either gave “unreasonable publicity” to or “disclosed” information about an individual’s private life.
Travelers argued that there could not be “publication” when the insured’s business was the protection of information and there was no evidence that a third party actually viewed the information.
The District Court determined in the first instance that “publication” does not refer to intent (whether intentionally or unintentionally disclosed) so that argument was rejected. As to the second element, the court noted that publication occurs when placed “before the public,” without reference to whether the public actually reads the information.
Under the second requirement for coverage, Travelers maintained that “publicity” required a proactive step to “attract” interest, and “disclosure” requires a third party to actually view. The District Court held that publicity was unreasonable due to the nature of the sensitive information contained in the medical records and there was no requirement that the insured take overt action to attract attention to the information.
As to the “disclosure” argument, the District Court held that disclosure occurred when the possibility of viewing by a third party happened, not when or if a third party actually viewed the information.
The District Court also addressed the fact that there was no express exclusion of the actual security failure involved and at a minimum the insurance carrier would have to defend (although it could still later argue it had no duty to indemnify) based on the law that such an ambiguity is decided in favor of the insured.
This makes it clear that it is critical to pay attention to the type of coverage purchased and to the fine print. It may also be helpful to have an insurance agent review the types of coverage you have, to look for gaps based on your business and possible risks, since each policy type includes those risks which are intentionally covered and others which are expressly excluded. Although the types of policies continue to expand to cover new technologies and new risks, depending on the carrier and the policy’s exclusion language, the coverage may not be what you think it is.
Thanks for this article. I had seen another on the same topic, that just said the court found coverage under a traditional CGL policy. But that didn’t sound right to me when I read the opinion (which did not mention the policy language either). Your description of the 2012 endorsement and the AI definition in the 2013 policy was helpful. Thanks again.