Background
In April 2013, Portal was sued in a class action in New York by two plaintiffs who Googled their names and found the first search result linked to their confidential medical records, hosted on a website maintained by Portal. The plaintiffs alleged negligence, breach of warranty and breach of contract, arguing that their private medical records were freely accessible online for four months as a result of Portal’s tortious conduct.
Portal sought coverage for the class action under its CGL. Travelers insured Portal under two policies: one that spanned the period from January 2012 to January 2013 and one that spanned from January 2013 to January 2014. These policies provided that Travelers must insure against damages arising from “electronic publication of material that” gives “unreasonable publicity to” or “discloses information” about a “person’s private life.”
Travelers rejected coverage and instead sued Portal in the Eastern District of Virginia, seeking a declaration that it was under no obligation to defend Portal, because the class action complaint failed to allege a “publication” and thus failed to fall within the scope of Portal’s general liability policy. See Travelers Indem. Co. v. Portal Healthcare Solutions, LLC, 35 F. Supp.3d 765 (E.D. Va. 2014).
The district court employed the “Eight Corners Rule,” which instructs courts to look to the four corners of the underlying complaint as well as the four corners of the underlying insurance policies. Accordingly, the court looked at the plain meaning of the Travelers policy. First, the district court adopted the dictionary definition of “publication” to mean “to place before the public (as through a mass medium).” The court determined that the general availability of the records online was “publication” within this plain meaning. Travelers mounted two arguments that the availability of the records online did not qualify as publication: (1) the “entire purpose” of Portal’s services was to keep medical information confidential and (2) because no third party was alleged to have viewed the information, there could be no publication. The court dismissed both easily, reasoning that neither a party’s intent to publish the information nor a third party’s viewing of the information was required by the definition.
Next, the district court defined “publicity” as “the quality or state of being obvious or exposed to the general view,” and “disclosure” as “the act or process of making known something that was previously unknown; a revelation of facts.” The court stated definitively that “[t]here can be no question that posting medical records online without security restrictions exposes the records to the general view and thus, gives the records ‘publicity’ since, quite literally, any member of the public can view, download, or copy those records.” Travelers argued that no “publicity” occurred when Portal posted the records online because Portal did not take steps designed to attract public interest, and that Portal’s conduct did not “disclose” the patients’ privates lives because the patients in the class action only viewed their own records.
Ultimately, the district court concluded that the complaint at least “potentially or arguably” alleged a “publication” of private medical information that would constitute conduct under the two policies. Thus, Travelers was responsible for defending Portal in the class action suit.
On appeal, the 4th Circuit noted the district court’s “sound legal analysis” and held that “[g]iven the eight corners of the pertinent documents, Travelers’s efforts to parse alternative dictionary definitions do not absolve it of the duty to defend Portal.” Travelers Indem. Co. v. Portal Healthcare Solutions, LLC, No. 14-1944 (4th Cir. Apr. 11, 2016).
Analysis and Potential Impact of the Travelers Decision
While the Portal decision is a big win for companies, its impact will likely be limited by the CGL policies currently being issued. CGL policies typically cover insureds for damages due to injury to “tangible” property and/or due to an invasion of the right to privacy (e.g., publication of private information). Data breaches present unusual circumstances and consequences for CGL policies. Millions of individuals can be affected by a single data breach that may have existed for years undetected. Given this uncertainty, most insurers have tightened up CGL policies to specifically exclude data breaches.
While the Travelers court applied Virginia’s Eight Corners doctrine, regardless of circuit or state law, the court’s decision points to perhaps a broader understanding of “publication” in a digital age. When records or other information are posted online without encryption, they are generally accessible in the same way a book in a library is accessible. Whether a third party views the information is likely to become less important in courts’ future analysis of elements like “publication” in the insurance context when considered in a digital setting.