4th Cir. Finds Defense Duty For Data Security Breach

Unintentional unrestricted posting of private medical information on the internet constitutes publication even if no allegation that third-parties actually viewed.

The Fourth Circuit, applying Virginia law, affirmed the district court and held that Travelers Indemnity Company of America (“Travelers”) must defend its insured, Portal Healthcare Solutions, L.L.C. (“Portal”), against a class action lawsuit pending in New York state court alleging negligence, breach of warranty, and breach of contract due to a data security breach.  The class action alleged that Portal failed to safeguard confidential medical records which resulted in the plaintiffs’ private medical records being available on the internet by unauthorized persons without any security restriction.

Travelers sought a declaration that it was not obligated to defend Portal against the claims in the class action lawsuit because, according to Travelers, the class action suit fails to allege a “publication” by Portal.  The district court ruled that, under the terms of its policies, Travelers had a duty to defend Portal against the class action suit.  Under the policies, Travelers was required to pay sums Portal became legally obligated to pay as damages because of injury arising from the “publication” of material that “discloses information about a person’s private life” or “gives unreasonable publicity to a persons’ private life.”  The terms “publication,” “publicity,” and “disclosure” were undefined by the Travelers policies.  According to Virginia law, the court was required to determine the “plain and ordinary meaning” of the terms.  Travelers provided the court with dictionary definitions for each of the terms.   Publication was defined by the dictionary as meaning “to place before the public (as through a mass medium).”  Travelers argued that there could not have been publication because (1) Portal did not intend to expose the records to public viewing and (2) no third party was alleged to have viewed the information.  The court did not find these arguments persuasive and found that the only question was whether the information was “placed before the public.”  The district court held that the making of medical records publicly accessible via an internet search falls within the plain meaning of “publication.”

According to the dictionary definition provided by Travelers, “publicity” meant “the quality or state of being obvious or exposed to the general view.”  The court found that “there can be no question that posting medical records online without security restriction exposes the records to the general view and, thus, gives the records ‘publicity’ since, quite literally, any member of the public can view, download, or copy those records.”  Travelers provided the court with the following definition for “disclosure:” “[t]he act or process of making known something that was previously unknown; a revelation of facts.”  The court found that the unrestricted posting of medical records on the internet “made medical records that were previously known only to the patient suddenly known to the public at large.”   The district court directed Travelers to provide a defense to Portal against the underlying class action suit because the class action “at least potentially” alleged a “publication” of private medical information by Portal.

On appeal, the Fourth Circuit praised the district court’s “sound legal analysis” and affirmed the district court’s ruling that Travelers had a duty to defend Portal in the class action suit.  Travelers Indem. Co. of Amer. v. Portal Healthcare Solutions, L.L.C., No. 14-1944 (Apr. 11, 2016); Travelers Indem. Co. of Amer. V. Portal Healthcare Solutions, L.L.C., 35 F. Supp. 3d 765 (E.D. Va. Aug. 7, 2014).

Leave a Reply