| April 13, 2016 |
| Fourth Circuit Holds Coverage Allowed for Data Breach Under Commercial General Liability Policy |
In Travelers Indemnity Company of America v. Portal Healthcare Solutions, L.L.C., No. 14-1944 (4th Cir. (Va.) April 11, 2016), Travelers Indemnity Company of America appeals from an order entered in the Eastern District of Virginia directing it to defend its insured, Portal Healthcare Solutions, L.L.C., against a civil lawsuit pending in New York state court. The underlying lawsuit was a class action complaint filed against Portal Healthcare Solutions, L.L.C. and others for allowing unauthorized access to patients' medical records. Notably, Portal contracted with an upstate New York hospital to provide medical record hosting services. It is then alleged that for a span of approximately four months, patient information contained on the Portal servers was viewable by unauthorized persons. During the alleged tortious conduct, Portal was the insured under two insurance policies issued by Travelers, one that spanned the period from January 2012 to January 2013, and another that ran from January 2013 to January 2014 (the "Policies").
Travelers sued Portal in the Eastern District of Virginia, seeking a declaration that it is not obliged to defend Portal against the claims in the class-action complaint. Travelers argued that there is no obligation to defend because the class- action complaint fails to allege a covered publication by Portal. Travelers and Portal each moved for summary judgment on the duty-to-defend issue.
The district court held that the class-action complaint "at least potentially or arguably" alleged a "publication" of private medical information by Portal that constitutes conduct covered under the Policies. Such conduct, if proven, would have given "unreasonable publicity to, and disclose[d] information about, patients' private lives," because any member of the public with an internet connection could have viewed the plaintiffs' private medical records during the time the records were available online. Therefore,the district court ruled that Travelers had a duty under the Policies to defend Portal against the class-action complaint and granted summary judgment in favor of Portal.
On appeal, the court for the Fourth Circuit acknowledged Virginia's eight-corners rule and agreed with the district court's assessment that the class action complaint "at least potentially or arguably" alleged "publication" of private medical information. The court provided that since any member of the public with an Internet connection could have viewed the private information on Portal's servers, the Fourth Circuit concluded a "publication" could theoretically have occurred.