Fourth Circuit To Decide If Commercial General Liability Policy Covers Internet Publication of Medical Records

Written by: Tiffany Winks, Esq.

On March 24, 2015, the Fourth Circuit Court of Appeals heard oral arguments as to whether a Commercial General Liability insurance policy provides coverage for a data breach.  The case on appeal is Travelers Indemnity v. Portal Healthcare Solutions, LLC, 35 F. Supp. 3d 765, (E.D. Va. 2014).  The District Court had ruled that the policy did provide coverage, and Travelers appealed.

Travelers disputed that it had a duty to defend Portal against class-action allegations that Portal posted confidential medical records on the internet, making the records available to anyone who searched for a patient’s name and clicked on the first result. The case involves two policies that Travelers issued to Portal covering the electronic publication of certain materials. The two substantially identical insurance policies, which obligated Travelers to pay  damages because of injury arising from (1) the “electronic publication of material that … gives unreasonable publicity to a person’s private life” (the language found in the 2012 Policy) or (2) the “electronic publication of material that … discloses information about a person’s private life”.

Two patients discovered that when they conducted a “Google” search of their respective names, the first link that appeared was a direct link to their respective hospital’s medical records. The class-action suit alleged that patients’ confidential medical records were accessible, viewable, copyable, printable, and downloadable from the internet by unauthorized persons without security restriction from November 2, 2012 to March 14, 2013.

The main issue was whether there was a covered injury and if there was a “publication.”  The District Court had stated that “Publication occurs when information is ‘placed before the public,’ not when a member of the public reads the information placed before it. By Travelers’ logic, a book that is bound and placed on the shelves of Barnes & Noble is not ‘published’ until a customer takes the book off the shelf and reads it. Travelers’ understanding of the term ‘publication’ does not comport with the term’s plain meaning, and the medical records were published the moment they became accessible to the public via an online search.”  As a result, the Court found that the complaint constituted at least “potentially and arguably” “publication” within the meaning of the Policies. Next, the Court found that the public availability of a patient’s confidential medical records gave “unreasonable publicity” to that patient’s private life and disclosed information about that patient’s private life, satisfying the Policies’ second prerequisite to coverage.

Stay tuned for a follow-up post when the Fourth Circuit issues their ruling.