E-Alert Case Updates

Fourth Circuit Holds that Insurer Must Defend Insured In Data Breach Case

The Travelers Indemnity Company of America v. Portal Healthcare Solutions, LLC
No. 14-1944, (United States Court of Appeals for the Fourth Circuit, April 16, 2016)
by Caroline E. Willsey, Law Clerk
Semmes, Bowen & Semmes (www.semmes.com)

Available at: http://www.ca4.uscourts.gov/Opinions/Unpublished/141944.U.pdf

In The Travelers Insurance Company of America v. Portal Healthcare Solutions, the Fourth Circuit issued a per curiam decision on an appeal by The Travelers Indemnity Company of America (“Travelers”) from an order directing it to defend its insured, Portal Healthcare Solutions, LLC (“Portal”) in a civil data breach lawsuit. Portal specializes in the electronic safekeeping of medical records for hospitals, clinics and other medical providers. Portal failed to safeguard the confidential medical records of patients at Glen Falls Hospital, in New York, and inadvertently posted these records on the Internet, causing them to be publically accessible. Under the policies at issue, Travelers was obligated to defend Portal for “publication” giving “unreasonable publicity” to, or “disclos[ing]” information about a person’s private life.

On April 18, 2013, Dara Halliday and Teresa Green (collectively “Plaintiffs”) filed a class action lawsuit against Portal as a result of this leaked medical data. During Portal’s allegedly tortious conduct, Portal was insured under two (2) insurance policies issued by Travelers. On July 30, 2013, Travelers sued Portal in the Eastern District of Virginia, seeking a declaratory judgment that it had no duty to defend Portal against the claims in the class action complaint. Portal and Travelers each moved for summary judgment. The district court ruled that Travelers was bound under the insurance policies to defend Portal against the class action.

The Fourth Circuit commended the district court’s legal analysis. Under Virginia law, the district court was required to follow the “Eight Corners Rule” by looking to the four (4) corners of the class-action complaint and the four (4) corners of the underlying insurance policies. In Virginia, an insurer’s duty to defend an insured is broader than its obligation to pay or indemnify and insured. If the insurer does not want to provide a particular type of coverage, the insurer must use clear language and avoid ambiguity. The Court did not discuss the particulars of any exclusions in the policies at issue in this case.

Applying the legal principles above, the district court concluded, and the Fourth Circuit agreed, that the class action complaint – which alleged that Portal made confidential records publically accessible via an Internet search – alleged a “publication” of private material by Portal. The term “publication” was not defined in the insurance policies. In its defense, Travelers first argued that because Portal intended to keep the records private, there could not have been a “publication.” Second, Travelers argued that Portal did not effectuate a “publication” because no third party was alleged to have viewed the medical records online. The district court rejected both of these arguments, stating that “because [the] medical records were placed before the public, the Court finds that Portal’s conduct falls within the plain meaning of ‘publication.’”

The Fourth Circuit also agreed with the district court’s conclusion that Portal’s conduct, if proven, would have given “unreasonable publicity to, and disclose[d] information about, patients’ private lives” because any member of the public could have viewed Plaintiffs’ private medical records on the Internet. Travelers again argued that no “publicity” or “disclosure” occurred because Portal did not take steps designed to attract public interest to make known the information contained in Plaintiffs’ medical records. The district court rejected these arguments, concluding that under the plain meaning of both “publicity” and “disclosure,” intent was not a necessary element.

Without further analysis, the Fourth Circuit affirmed the district court’s opinion that Travelers had a duty to defend Portal against the class action complaint. Given that the eight (8) corners of the pertinent documents did not provide alternative definitions of the terms at issue, any ambiguity as to the meaning of the terms must be construed in favor of an interpretation which grants coverage, rather than withholds it.