Travelers issued a CGL or commercial general liability policy to Portal Healthcare Solutions in 2012 and renewed it in 2013. Portal has been sued in a class action lawsuit pending in Virginia. Travelers denied all coverage including a defense.
The Fourth Circuit succinctly described the underlying class action against Portal in these words:
The class-action complaint alleges that Portal and others engaged in conduct that resulted in the plaintiffs’ private medical records being on the internet for more than four months.
Travelers decided to test its duty to defend a cyberbreach under its CGL policies by filing suit in the Eastern District of Virginia for declaratory relief. The Travelers clearly felt very sure of its disclaimer decision; it decided to file this dec action after leaving its insured without a defense.
The District Judge entered a summary judgment against Travelers and in favor of Travelers' insured, Portal.
On Monday of this week, the Fourth Circuit Court of Appeals affirmed the District Court's summary judgment, again wasting no words:
Put succinctly, we agree with the Opinion that Travelers has a duty to defend Portal against the class-action complaint. Given the eight corners of the pertinent documents, Travelers’s efforts to parse alternative dictionary definitions do not absolve it of the duty to defend Portal.
Parenthetically, the Fourth Circuit opinion was issued as "non-precedential" in the Fourth Circuit. However, the District Court decision has been published in F. Supp. One will be formal precedent within the Fourth Circuit; both will be precedent everywhere else in all likelihood.
Put succinctly, The Travelers could have done better than disclaim a duty to defend a class action in which the plaintiffs alleged that their medical records were posted on the internet for more than four months on account of what the defendant did or did not do. It certainly could have done a lot better than compounding that disclaimer decision by filing a lawsuit against its insured to prove how right it was to disclaim all coverage for the claims of the people whose medical records ended up on the internet.
Why did they ever think that this was a good case to disclaim all coverage including to disclaim a duty to defend? This case is an outlier in that sense. Most liability carriers would have provided a defense and issued a reservation of rights to deny coverage later, then they would have filed a dec action. As it stands, the issue of CGL coverage for a cyberbreach is what people will take away from what is really a decision on the Virginia (and majority) view of the duty to defend.
Please Read The Disclaimer. ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016). All rights reserved.