Fourth Circuit Finds GCL Insurer Owed Duty to Defend Cyber-Related Claims
The United States Court of Appeals for the Fourth Circuit has affirmed a lower court ruling holding that an insurer’s duty to defend was triggered under Coverage B of a general liability insurance policy by allegations that a policyholder was responsible for private health information appearing on a publicly-accessible website. Travelers Indem. Co. v. Portal Healthcare Solutions LLC, 14-1944, 2016 U.S. App. Lexis 6554 (4th Cir. Apr. 11, 2016) (unpublished).
The policyholder, a company that electronically stored and maintained patients’ confidential medical records, was sued in a class action lawsuit based on allegations that certain claimants were able to access their medical records in the policyholder’s possession by conducting a Google search of their respective names and clicking on the first search result that came up. Specifically, the claimants alleged that their medical records were accessible, viewable, copyable, printable, and downloadable from the internet by unauthorized persons and without security restriction for a period of nearly five months. The policyholder sought coverage under two consecutive commercial general liability policies that it had been issued, and a coverage action soon followed. The policies at issue provided specified Coverage B insurance coverage for “electronic publication of material that” “gives unreasonable publicity to” or “ discloses information about” “a person’s private life.”
On cross motions for summary judgment, the trial court ruled that the insurer had a duty to defend the policyholder against the underlying suit. The trial court believed that the term “publication,” which was defined by one dictionary to mean “to place before the public (as through a mass medium),” could be satisfied by the exposure of medical records to the online searching of a patient’ s name, followed by a click on the first search result. It held that the insurer owed a duty to defend, finding the underlying complaint at least potentially or arguably alleged conduct covered under the policies. Travelers Indem. Co. v. Portal Healthcare Solutions, LLC, 35 F. Supp. 3d 765 (E.D. Va. 2014). The insurer appealed to the U.S. Court of Appeals for the Fourth Circuit.
In an unpublished per curiam opinion, the Fourth Circuit affirmed a duty to defend based on the reasoning of the lower court. In its short ruling, the Fourth Circuit did not directly address the arguments demonstrating that no “publication” takes place when there is no proof that a third-party accessed the information, and where the insured took no steps designed to disseminate or publish the material at all. Citing the “eight-corners rule” (requiring analysis to be based on the four corners of the underlying complaint and the four corners of the insurance policies) and the broad duty to defend standard, the Fourth Circuit concluded that the opinion below correctly concluded that the class-action complaint “at least potentially or arguably” alleged a “publication” of private medical information by Portal that constitutes conduct covered under the policies.