Fourth Circuit Affirms CGL Duty to Defend for Medical Records Breach

The Fourth Circuit Court of Appeals has affirmed a Virginia federal district court’s summary judgment ruling for the insured under a CGL policy, finding that the insurer had a duty to defend a third-party lawsuit alleging failure to properly secure electronic storage of medical records. Travelers Indemnity Co. v. Portal Healthcare Solutions, LLC, No. 14-1944 (4th Cir. Apr. 11, 2016). A copy of the appellate court’s unpublished opinion is available here.

Glen Falls Hospital contracted with the insured, Porter Healthcare Solutions, LLC, for the electronic storage and maintenance of the hospital’s confidential medical records. Two patients discovered that when they searched for their names in an online engine, the first result was a direct link to their Glen Falls medical records. The patients brought a class action lawsuit alleging that Portal failed to safeguard their confidential medical records. Portal sought coverage under two Travelers CGL policies. The policies cover “electronic publication of material” that, depending on the policy year, either “gives unreasonable publicity to” or “discloses information about a person’s private life”. Travelers brought an action in the Eastern District of Virginia seeking a declaration that it is not required to defend Portal in the class action lawsuit, on grounds that the underlying suit did not allege a covered publication under the policies. See 35 F. Supp. 3d 765, 767-68 (E.D. Va. 2014).

On the parties’ cross-motions for summary judgment, the district court granted Portal’s motion, holding that “exposing material to the online searching of a patient’s name does constitute a ‘publication’ of electronic material” for purposes of the Travelers policies. Id. at 770. Addressing Travelers’ argument that no third party was alleged to have viewed the records, the district court said that the definition of “publication” did not hinge on third-party access – but rather occurs when the information is “placed before the public”. Id. at 770-71. The court proceeded to find that in addition to publication, the public availability of records also satisfied the second requisite for coverage, i.e., that the public availability of records was “unreasonable publicity” and disclosed information about the patient’s private life. Id. at 771-72. The district court therefore found that Travelers had a duty to defend under the policies. (The court did not address whether the policies would cover any potential judgment or settlement against Portal.)

The Fourth Circuit affirmed, commending the district court for its “sound legal analysis”. The appellate court adopted the district court’s reasoning that the third-party lawsuit alleged conduct which, “if proven, would have given ‘unreasonable publicity to, and disclosed[d] information about, patient’s private lives,’ because any member of the public with an internet connection could have viewed the plaintiffs’ private medical records during the time the records were available online.” (Slip Op. at 7)

The Fourth Circuit’s ruling starkly illustrates that the issue of coverage for data breach lawsuits under CGL and other traditional policies is by no means settled. The decision joins a collection of varying results on this issue that depend heavily on the particular facts of each case, the policy language, and jurisdiction.

Molly McGinnis Stine is a partner and John F. Kloecker is Of Counsel in Locke Lord’s Chicago office. They can be reached at mmstine@lockelord.com and jkloecker@lockelord.com.