In a recent decision of interest to corporate policyholders exposed to liability claims for data breaches or unauthorized disclosure of confidential information, a federal circuit court of appeals has ruled that coverage for liability claims arising from the unlawful exposure of medical records over the internet may exist under a policy providing coverage for the electronic publication of confidential patient information. Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, L.L.C., 2016 WL 1399517 (4^th Cir. 2016).  The appellate court affirmed the judgment and reasoning of the district court which rendered judgment in favor of the policyholder and held that Travelers was required to defend its insured in a class-action lawsuit alleging damages for the unlawful disclosure of confidential medical information.  See Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, L.L.C., 35 F.Supp.3d 765 (E.D. Va. 2014).

The insurance coverage dispute in the Portal Healthcare case arose from Portal Healthcare’s contract with a hospital, under which Portal was responsible for the electronic storage and maintenance of hospital patients’ confidential medical records.  Portal was named as a defendant in a class-action lawsuit after two patients of the hospital discovered a link to their hospital medical records when they conducted a Google search of their names on the internet.  The class-action lawsuit alleged claims for negligence, breach of warranty, breach of contract and injunctive relief arising from Portal Healthcare’s alleged failure to safeguard the confidential medical records and causing the records to become publicly accessible on the internet. 

Portal requested its insurer Travelers to defend the lawsuit under two insurance policies Portal purchased from Travelers. Each policy required Travelers to pay any sums that Portal Healthcare becomes legally obligated to pay as damages because of injury arising from “the electronic publication of material that gives . . . unreasonable publicity to a person’s private life” or “the electronic publication of material that . . . discloses information about a person’s private life.” Portal Healthcare, 35 F.Supp.3d 765, 767.  Travelers refused to defend Portal Healthcare because it claimed that the alleged conduct of its insured did not constitute a “publication” that gave “unreasonable publicity” to the patients’ private life and that there was no disclosure of information.  The district court rejected Travelers’ claims and entered judgment in favor of Portal Healthcare, and the appellate court agreed with the reasoning of the district court.  You may read the appellate court’s decision here.

First, the district court determined that exposing material to the public through internet searching constitutes a publication of electronic material. In denying any duty to provide coverage under the policies, Travelers argued that there was no “publication” of material because Portal Healthcare did not intend to expose the medial records to public viewing.  The court concluded, however, that the intent of the policyholder was not material and that a publication of material can occur through intentional and unintentional conduct.  The court also rejected Travelers’ argument that no publication occurred because there was no evidence that a third party viewed the confidential information.  The court ruled that a publication occurs when information is placed before the public, not when a member of the public reads the information.  According to the court, the medical records at issue were published the moment they became accessible to the public through a search on the internet.

The appellate court also agreed with the district court’s conclusion that the publication of the medical records gave “unreasonable publicity” to the patient’s private life and “disclosed” information about a patient’s private life as those terms were written in the Travelers’ policy because the public availability of the confidential material disclosed information about the patient’s private life. The court rejected Travelers’ argument that no publicity occurred when Portal posted the records online because Portal did not take any steps designed to attract public interest or attention to the confidential material.  The court concluded that the posting of the medical records satisfied the broader definition of publicity by being obvious or exposed to the general public view.  The medical records were “disclosed” as that term was used in the insurance policy when they were posted publicly online.  The court also disagreed with Travelers’ argument that the records were not disclosed because they were only viewed by the patients themselves and no one else.  The court concluded that disclosure of information does not require viewing by a third party so long as steps are taken to make previously unknown records known to the public at large.  

The Portal Healthcare decision may provide support for policyholders who seek coverage for liability claims arising from data breaches or unauthorized disclosure of confidential information.  The decision serves as a reminder that courts will look to the general dictionary meaning of terms written in an insurance policy if the insurance company does not define terms in the policy.  Also, courts will require insurers to defend their policyholders in litigation when a claim against the policyholder is arguably within the coverage purchased.  Policyholders faced with financial or legal exposure arising from unauthorized access to confidential information, however, should be proactive and review their insurance program with their insurance coverage counsel or other insurance professional to understand the availability of coverage for such claims under their existing insurance program and whether additional insurance is necessary.