This article was first published by Advisen on May 2, 2016.

In a solid victory for policyholders, the Fourth Circuit upheld coverage last week for a potential data breach incident involving confidential medical records.  The case is The Travelers Indemnity Co. of America v. Portal Healthcare Solutions, L.L.C.,[1] and involved coverage under two commercial general liability (CGL) insurance policies.

Significantly, and in contrast to the Recall Total case that was widely reported and debated last year,[2] the Fourth Circuit in Portal Healthcare confirmed that a covered “publication” of records can exist even if the records at issue are not actually accessed by any third party.  Rather, the Fourth Circuit confirmed that “publication” is satisfied for purposes of CGL coverage if the records are merely accessible.  Likewise, in contrast to the New York trial court’s decision in the Sony PlayStation data breach insurance coverage litigation,[3] the Fourth Circuit outright rejected the insurer’s argument that CGL coverage requires “intent” to publish the information, finding unintentional publication sufficient. 

Portal Healthcare provides insureds another arrow in the coverage quiver, serving as an important reminder that actual and potential data breaches may be covered under CGL and other traditional policies.

Here we offer a brief summary of the Portal Healthcare facts and holding—and 5 key takeaways.

Portal Facts And Holding
The insured in Portal Healthcare, Portal Healthcare Solutions, L.L.C., specializes in the electronic safekeeping of medical records for hospitals, clinics, and other medical providers.[4]  At issue in Portal Healthcare was whether Portal’s CGL insurer, Travelers, had a duty to defend Portal against class-action allegations that Portal failed to safeguard confidential medical records by posting those records on the internet and making them available to anyone who searched for a patient’s name and clicked on the first result.[5]

On cross motions for summary judgement in the insurance coverage litigation, the federal district court held that the posting of medical records was an electronic “publication,” and therefore covered under Portal’s CGL policies.[6]  Significantly, the court rejected Travelers’ argument that there was no covered “publication” because no third party was alleged to have viewed the information.[7]  Rather, applying established rules of insurance policy construction, the district court found that the undefined term “publication” required only that the records be “placed before the public”[8] and it therefore was not relevant whether or not the records were accessed by a third party.  Drawing analogy to a book placed on a Barnes & Noble shelf, the court noted that Travelers’ argument was contrary to the plain meaning of “publication”:

By Travelers’ logic, a book that is bound and placed on the shelves of Barnes & Noble is not “published” until a customer takes the book off the shelf and reads it. Travelers’ understanding of the term “publication” does not comport with the term’s plain meaning, and the medical records were published the moment they became accessible to the public via an online search.[9]

In reaching its decision, the district court distinguished the authorities relied upon by Travelers, including Recall Total,[10]  finding that Recall Total was inapposite because, in contrast to Recall Total, the information in Portal Healthcare “was posted on the internet and thus, was given not just to a single thief but to anyone with a computer and internet access.”[11]

In addition, and also significantly, the district court rejected Travelers’ proposition that “publication” requires an intent to publish by the insured, finding that “an unintentional publication is still a publication.”[12]  The court further explained that “the issue cannot be whether [the insured] intentionally exposed the records to public viewing since the definition of ‘publication’ does not hinge on the would-be publisher’s intent.  Rather, it hinges on whether the information was placed before the public.”[13]

The district court concluded that “the facts and circumstances alleged in the class-action complaint at least ‘potentially or arguably’ constitute a ‘publication’….”[14]  

The Fourth Circuit affirmed, commending the district court’s “sound legal analysis” and confirming that “Travelers has a duty to defend Portal against the class-action complaint.”[15]

The Takeaways
Portal Healthcare offers five key takeaways:

1. Remember “traditional” policies.  Portal Healthcare illustrates that there may be valuable data breach coverage under CGL and other traditional insurance policies—even in the absence of an actual breach of information.[16] This is important for organizations to remember because, while a growing number of organizations purchase specialty “cyber” and technology errors and omissions (E&O) policies, which are specifically designed to afford coverage for data breaches and other cybersecurity and data privacy-related risks, most organizations also have various forms of traditional insurance policies that may cover various types of cyber and privacy risks, including CGL, D&O, professional liability, property, and commercial crime policies, among others. In many circumstances there may be overlapping coverage under a number of the organization’s specialty and traditional insurance coverage.
    
2. Identify potential coverage—and potential coverage gaps—before a breach incident.  Organizations are advised to carefully consider potential coverage across their entire insurance portfolio in advance of a potential breach event and undertake a “gap” analysis.  While there may be valuable coverage under an organization’s CGL and other “traditional” insurance policies, insurers have made it abundantly clear that they do not want to cover “cyber” and various privacy-related exposures, including data breach, under traditional policies.  For this reason, insureds should be aware that they may face costly insurance litigation to secure coverage—even where there is a good argument in favor of coverage.  Likewise, in response to decisions upholding coverage for data breaches and other privacy-related exposures, the insurance industry has added various limitations and exclusions in recent years, which seek to cut off the “traditional” lines of coverage.  Most recently, ISO filed a number of data breach exclusionary endorsements for use with its standard-form primary, excess and umbrella CGL policies.  These became effective in May 2014.[17]  Although the full reach of the new exclusions ultimately will be determined by judicial review, from an enterprise risk management perspective, the newer exclusions provide another reason for companies to carefully consider specialty “cyber” insurance products.[18]
    
3. Carefully Consider—and negotiate—appropriate specialized coverage.  “Cyber” and technology E&O insurance coverage can be extremely valuable,[19] but choosing the right insurance product presents real and significant challenges. There is a diverse and growing array of cyber products in the marketplace, each with its own insurer-drafted terms and conditions that vary dramatically from insurer to insurer—and even between policies underwritten by the same insurer. In addition, the specific needs of different industry sectors, and different companies within those sectors, are far-reaching and diverse.  Although placing coverage in this dynamic space presents challenges, it also presents substantial opportunities. “Cyber” and technology E&O insurance policies are negotiable, and the terms of the insurer’s off-the-shelf policy forms can often be significantly enhanced and customized to respond to the insured’s particular circumstances.  Frequently, very significant enhancements can be achieved for no increase in premium.  It is important to identify the right cyber insurance product and then negotiate the coverage terms so that they reflect the reality of risk and the organization’s potential particular risk profile and exposure.
    
4. Don’t take “no” for an answer.  Unfortunately, even where there is a legitimate claim for coverage, an insurer may deny an insured’s claim.   Indeed, insurers can be expected to argue, as Portal’s insurers argued, that data breaches are not covered under CGL insurance policies.  In addition, disputes are now arising under newer specialty “cyber” and technology E&O policies.[20]  Nevertheless, insureds that refuse to take “no” for an answer may be able to secure valuable coverage if they effectively pursue their claim.[21] 
    
5. Maximize coverage across the entire insurance portfolio.  Various types of insurance policies may be triggered by a data breach incident, and those various triggered policies may carry different insurance limits, deductibles, retentions, and other self-insurance features, together with various different and potentially conflicting provisions addressing, for example, other insurance, erosion of self-insurance, and stacking of limits.  For this reason, in addition to considering the scope of substantive coverage under an organization’s various insurance policies, it is important for the organization to carefully consider the best strategy for pursing coverage in a manner that will most effectively and efficiently maximize the potentially available coverage across the insured’s entire insurance portfolio.  By way of example, if there is potentially overlapping CGL and “cyber” insurance coverage, an organization should keep in mind considerations such as the fact that defense costs often do not erode CGL policy limits.  Armed with the appropriate facts, the organization can structure the coverage strategy accordingly.

*          *          *          *          *

Portal Healthcare serves as an important reminder that, when facing a data breach event, and before an event occurs, organizations should carefully consider the insurance coverage that may be available to respond to a breach event and the most efficient ways to maximize coverage. 

Notes:
[1] --- Fed.Appx. ----, 2016 WL 1399517 (4th Cir. Apr. 11, 2016).

[9] Id. at 771.

[10] Affirming the trial and intermediate appellate courts, the Connecticut Supreme Court in Recall Total ultimately determined that the “publication” requirement was not satisfied because, as found by the intermediate appellate court, the plaintiffs “failed to provide a factual basis that the information on the tapes was ever accessed by anyone.”  Recall Total Info. Mgmt., Inc. v. Fed. Ins. Co., 83 A.3d 664, 673 (Conn. Super. Ct. 2014), aff’d 115 A.3d 458, 460 (Conn. 2015) (“Our examination of the record and briefs and our consideration of the arguments of the parties persuade us that the judgment of the Appellate Court should be affirmed.”).  Significantly, however, the intermediate appellate court in Recall Total noted that there was nothing in the record in that case to suggest that “the unknown party even recognized that the tapes contained personal information.”  Recall Total, 83 A.3d at 673 n.9.  In contrast to the very unique facts of Recall Total, there should be no question that a “publication” exists to trigger CGL coverage in a typical data breach circumstance.  See also Case Highlights Reasons To Consider Data Breach Insurance, Law360 (Jan. 14, 2014),  

[16] The current CGL standard-form policy covers the “offense” of “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.”   ISO Form CG 00 01 04 13 (2012), Section I, Coverage B, §14.e.  Considering this verbiage and similar iterations of the standard form language, numerous decisions have found coverage for a wide variety of claims alleging breach of privacy laws and regulations, including data breach.   

[20] 5 Tips For Success In Cyberinsurance Litigation, Law360 (July 30, 2015)

[21] See, e.g., Travelers Prop. Cas. Co. of Am., et al. v. Federal Recovery Servs., Inc., et al., 103 F.Supp.3d 1297 (D. Utah 2015); Columbia Cas. Co. v. Cottage Health Sys., No., 2:15-cv-03432 (C.D. Cal.) (filed May 7, 2015).  See also Takeaways From the First Cyberinsurance Lawsuit, The Legal Intelligencer (Aug. 25, 2015); The Devil in the “Cyber” Insurance Details, K&L Gates Commercial Disputes Alert, (June 11, 2015); Jeff Sistrunk, The State Of Cyber Coverage Law: 4 Key Decisions, Law360 (July 30, 2015)