On April 11, 2016, the U.S. Court of Appeals for the Fourth Circuit affirmed a ruling by Judge Gerald Bruce Lee of the U.S. District Court for the Eastern District of Virginia that Travelers Indemnity Company of America (“Travelers”) was required to defend Portal Healthcare Solutions, LLC (“Portal”) against a class action alleging a data breach under Portal’s commercial general liability (“CGL”) policies. The Fourth Circuit agreed with Judge Lee’s reasoning that posting confidential medical records online without security restrictions constitutes a publication that gives unreasonable publicity or discloses information about patients’ private lives, which was expressly covered under Portal’s commercial general liability policies with Travelers.
The underlying class action complaint alleged that Portal had failed to safeguard confidential medical records of patients by posting those records on the internet without any security restrictions. That complaint alleged that the records were publicly accessible, viewable, copyable, printable, and downloadable from the internet. For example, two patients had discovered that an internet search of their names returned a direct link to their unprotected medical records.
The issue in the ensuing coverage lawsuit between Travelers and Portal was whether Travelers had a duty to defend Portal under Portal’s CGL policies with Travelers based on the conduct alleged in the underlying class action. The District Court noted, and the Fourth Circuit reiterated, that under Virginia law, an insurer’s duty to defend is broader than its obligation to pay or indemnify an insured. Thus, to trigger Travelers’ duty to defend, the underlying class-action had only to “at least potentially or arguably” allege conduct covered under Portal’s insurance policies. The Fourth Circuit found that the “advertising injury” coverage provided by Travelers’ CGL policies in question applies to the “electronic publication of material that . . . gives unreasonable publicity to a person’s private life” and the “electronic publication of material that . . . discloses information about a person’s private life.”
The District Court and the Fourth Circuit agreed that the class-action complaint sufficiently alleged such covered conduct because making confidential medical records publicly accessible via an internet search constituted a publication that gave unreasonable publicity to or disclosed information about a person’s private life.
Although the Fourth Circuit’s opinion is unpublished, the decision confirms that traditional CGL policies may provide valuable coverage for data privacy lawsuits that frequently occur after cybersecurity incidents. In an amicus brief, the American Insurance Association and Complex Insurance Claims Litigation Association had argued that the alleged conduct was not covered by Portal’s commercial general liability insurance policies, suggesting that if Portal wanted coverage for lawsuits arising out of data breaches, it should have purchased a separate cyber policy. The Fourth Circuit rejected this argument, reasoning that an insurer “must use language clear enough to avoid ambiguity if there are particular types of coverage that it does not want to provide,” and holding that the advertising injury coverage provided by Portal’s policies did not exclude coverage for the claims alleged in the class action.
While commercial general liability policies increasingly do contain express exclusions for claims arising out of data breaches, and commercial general liability policies are no substitute for the broader insurance coverage typically found under most cyber policies available in the marketplace today, the Fourth Circuit’s decision serves as an important reminder that CGL coverage also may respond to claims arising out of cybersecurity incidents, depending on policy wording. Policyholders should work closely with their broker and coverage counsel in the event of a breach to maximize their potential insurance recovery.
The Fourth Circuit’s unpublished opinion is available here.
Reporter, Stephen R. Shin, New York, +1 212 556 2198, sshin@kslaw.com
