Fourth Circuit Court of Appeals Holds Insurer Obligated to Defend Data Breach Claims Under Commercial General Liability Policy

By

In Travelers Indemnity Company of American v. Portal Healthcare Solutions, LLC, Appeal No. 14-1944 (4th Cir. Apr. 11, 2016), the Fourth Circuit Court of Appeals held that Travelers must defend Portal Healthcare, a medical records company, against a class action lawsuit under a personal and advertising injury coverage provision in a Traveler’s commercial general liability policy (CGL Policy.)

The lawsuit against Portal alleges that Portal’s conduct improperly allowed class members’ private health information to be publicly available on the internet.  The United States District Court for the Eastern District of Virginia held that Travelers had a duty to defend Portal because (1) the private health information was electronically published when it was placed before the public on the internet; and (2) posting medical records online without security restrictions resulted in an unreasonable publicity of patients’ private lives.  See Transcript at 29-36, Travelers Indemnity Company of American v. Portal Healthcare Solutions, LLC, Civil No. 13-CV-917 (E. D. Va. July 14, 2014).

The Fourth Circuit Court of Appeals affirmed the district court’s decision concluding Travelers had a duty to defend under the personal and advertising injury coverage provision in the CGL Policy.  In so holding, the Fourth Circuit rejected Travelers’ attempts to parse alternative dictionary definitions explaining that Travelers’ duty to defend arose under the “Eight Corners Rule” and the principle that ambiguities about coverage should result in a grant of coverage:

[W]e agree with the Opinion that Travelers has a duty to defend Portal against the class-action complaint.  Given the eight corners of the pertinent documents, Travelers’ efforts to parse alternative dictionary definitions do not absolve it of the duty to defend Portal.

Travelers Indemnity Company of American v. Portal Healthcare Solutions, LLC, Appeal No. 14-1944, slip op. at 7-8 (4th Cir. Apr. 11, 2016) (citing Seals v. Erie Ins. Exch., 674 S.E.2d 860, 862 (Va. 2009) (“observing that the courts ‘have been consistent in construing the language of [insurance] policies, where there is doubt as to their meaning, in favor of that interpretation which grants coverage, rather than that which withholds it.’” (quoting St. Paul Fire & Marine Ins. Co. v. S.L. Nusbaum & Co., 316 S.E.2d 734, 736 (Va. 1984)).

This opinion by the Fourth Circuit Court of Appeals, although unpublished, may have far-reaching consequences to insurers and insureds, particularly when analyzing insurance coverage under CGL policies for data privacy claims.  Many existing policies contain similar personal and advertising injury coverage provisions, do not expressly exclude such claims from coverage, and, therefore, may apply to data privacy claims under a similar coverage analysis.