The U.S. Fourth Circuit Court of Appeals held that an insurer had a duty to defend a class-action lawsuit alleging that it made the plaintiffs’ private medical records accessible on the internet. Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, L.L.C., 2016 WL 1399517 (4th Cir. Apr. 11, 2016).

A class-action complaint alleged that the insured “engaged in conduct that resulted in plaintiffs’ private medical records being on the internet for more than four months.” Its insurer sought a declaratory judgment that it had no duty to defend the insured under a policy covering certain “publications” of information, arguing that the complaint failed to allege a covered publication by the insured.

Following Virginia’s “eight corners” rule, the Fourth Circuit ruled that the class-action complaint did, in fact, give rise to a duty to defend. The complaint arguably alleged a “publication” qualifying as covered conduct under the policies, because the allegations, if proven, gave “unreasonable publicity to, and disclosed information about, patients’ private lives.” The court noted that “any member of the public with an internet connection could have viewed the plaintiffs’ private medical records during the time the records were available online” via an internet search, rendering untenable the insurer’s claim that there was no covered “publication” of information.