A U.S. appeals court yesterday held that a traditional corporate general liability policy triggered an insurer’s duty to defend a class action lawsuit alleging that a medical records company failed to properly secure patient records on its server.

In an unpublished opinion, a three-judge panel of the U.S. Court of Appeals for the Fourth Circuit affirmed a district court ruling that general liability policies required Travelers Indemnity Company of America (“Travelers”) to defend claims that Portal Healthcare Solutions, LLC (“Portal”) caused confidential medical records to be freely available to anyone with an Internet connection and web browser.

The underlying class action lawsuit alleges that Portal negligently failed to secure a server containing the records.  The complaint alleges that patients searched for themselves using Google and were able to find their own medical records, unsecured by passwords or encryption.  Portal sued the insurer for a declaratory judgment after Travelers declined to defend the putative class action, taking the position that the class complaint did not allege a “covered event.”

At issue were two requirements in the general commercial liability policies issued by Travelers that covered the electronic “publication” of specified materials that would give “unreasonable publicity” to or “disclose” information about a person’s private life.  The Court concluded that both the publication and disclosure requirements were met.  The mere exposure of patient information to the Internet – making the information searchable by name – sufficed to constitute publication under the policy.  And, the Court further held, the public availability of patient information on the Internet constituted “disclosure” as defined by the policy.

The Fourth Circuit held that the district court’s grant of summary judgment in Portal’s favor was correct, and that the lower court had properly applied the “eight corners” rule by comparing the policy language to the allegations made in the complaint to determine whether the insurer was required to defend Portal.  The court noted that, under Virginia law, the duty to defend “is broader than its obligation to pay or indemnify” and that an insurer must use “clear language to avoid … ambiguity if there are particular types of coverage that it does not want to provide.”

“[T]ravelers has a duty to defend Portal against the class-action complaint … Travelers’s efforts to parse alternative dictionary definitions do not absolve it of the duty to defend Portal,” wrote the Fourth Circuit.