Fourth Circuit Holds that a Data Breach Is Covered by a Commercial General Liability Policy

In an unpublished opinion issued on April 11, 2016, the Court of Appeals for the Fourth Circuit held in The Travelers Indemnity Co. of Am. v. Portal Healthcare Solutions, L.L.C. (http://www.ca4.uscourts.gov/Opinions/Unpublished/141944.U.pdf) that Travelers must defend a medical records company, Portal Healthcare, in a putative class action pending in New York state court alleging data breaches.

The underlying class action alleged that, between November 2012 and March 2013, Portal Healthcare negligently failed to secure a server containing confidential records for patients at a facility in New York. This, in turn, made the records available for anyone to view online without a password. When two patients searched for themselves on Google, they discovered that their medical records were publicly available. Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, L.L.C., 35 F. Supp. 3d 765, 768 (E.D. Va. 2014).

Travelers issued two commercial general liability policies to Portal Healthcare between January 2012 and January 2014. The policies required Travelers to defend and indemnify Portal Healthcare for injuries arising from the "electronic publication of material that ... gives unreasonable publicity to a person’s private life," or the "electronic publication of material that ... discloses information about a person’s private life."

Travelers brought a declaratory action in July 2013 seeking a judgment that it was not obligated to defend Portal Healthcare against the class action because the class action failed to allege a covered publication by Portal Healthcare. The district court rejected this argument, reasoning that making confidential medical records publicly available on the internet: (i) was within the plain meaning of publication; and (ii) gave unreasonable publicity to and disclosure of information about patients’ private lives. Thus, the court held that Travelers was required to defend Portal Healthcare in the underlying class action.

Travelers appealed and, in a per curiam decision, the Fourth Circuit affirmed the district court’s decision, "commend[ing] the district court for its sound legal analysis." The Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, L.L.C., No. 14-1944, at 6. Adopting the district court’s reasoning, the Fourth Circuit stated that "the class-action complaint ‘'t least potentially or arguably' alleges a 'publication' of private medical information by Portal that constitutes conduct covered under the policies." Thus, the court concluded that Travelers has a duty to defend Portal Healthcare against the class action complaint.

The Fourth Circuit’s decision is a departure from the approach of other courts, which have held that a traditional commercial general liability policy does not cover damages from data breaches.

Most importantly, however, this case highlights that as more and more companies incur significant expenses and become the targets of law suits as a result of data breaches, it is essential to revisit your insurance coverage to determine whether such a data breach is covered by an existing, traditional policy or if you need additional, more specialized coverage.