Why it matters: The Eleventh Circuit Court of Appeals held that a pair of commercial general liability (CGL) insurers may be on the hook for defense of a lawsuit alleging violations of the Health Insurance Portability and Accountability Act (HIPAA) filed against a policyholder. The insured was sued for falsely claiming to provide quality security services, and failing to conduct a background check or provide the proper training for an employee who allegedly stole three laptops containing HIPAA-protected personal data belonging to a client. The policyholder settled the suit and then sued three insurers for reimbursement: an employment practices liability carrier and two CGL insurers. A federal court judge granted summary judgment in favor of all three insurers. In an unpublished opinion, the Eleventh Circuit reversed as to the CGL insurers. The federal district court erred by not considering whether Florida or Maryland law applied to the dispute, the panel said. Given the differences between the states' laws when considering ambiguities in a policy, and the dispute between the parties as certain phrasing in the CGL policies, the panel reversed and remanded the case.

Detailed discussion: Admiral Security Services provides janitorial, security, and alarm services. Admiral entered into a "Protective Services Agreement" with AvMed in 2009, agreeing to provide security services at AvMed's premises. A few months later, an Admiral security guard stole several laptop computers from AvMed that contained a wealth of private and personal information concerning AvMed members, including data protected by HIPAA.

AvMed sued Admiral to recover its losses (including the costs of notifying those affected by the breach, providing two years of free credit protection, and resolving a class action lawsuit filed by victims of the breach) on two theories of liability: negligent supervision of its employee and vicarious liability. AvMed and Admiral reached a confidential settlement in 2012.

During the course of the litigation, Admiral tendered defense of the AvMed suit to three insurers: Carolina Casualty, which issued an employment practices liability policy, as well as two commercial general liability (CGL) insurers, Continental Casualty Company and National Union Fire Insurance Co. of Pittsburgh.

The insurers responded with a declaratory judgment action, contending that they owed no coverage. Applying the law of either Florida (the forum state) or Maryland (the state where the contract was executed), the result was the same, a federal district court said, granting summary judgment in favor of the insurers.

Admiral appealed to the Eleventh Circuit.

Reviewing the choice of law, the panel found that the lower court erred in stating that there was no conflict because the result was the same under both states' law. "When construing insurance policies Florida and Maryland courts start in the same place: They interpret the plain language of the policy as a whole," the appellate panel wrote. "But their constructions of ambiguous language differ in an important way."

Florida courts construe ambiguous terms in insurance contracts liberally in favor of the insured and strictly against the drafter who prepared the policy, the court explained, while Maryland courts construe insurance policies in the same manner as contracts generally—and not most strongly against the insurer.

"When the district court ruled that Florida and Maryland law led to the same result in this lawsuit, it failed to acknowledge that the two are different," the court said. Performing the necessary analysis, the panel concluded that the failure to recognize the distinctions between the states' laws did not affect the judgment in favor of Carolina Casualty.

"The dispute between Admiral and Carolina Casualty turns on the meaning of the phrase 'employment relationship' and whether that phrase applies to Admiral's relationship with AvMed," the court said. "Even if we apply Florida's rule that ambiguous terms in insurance contracts are construed 'liberally in favor of the insured,' Admiral and AvMed did not have such an 'employment relationship.' Reviewing the policy as a whole, we hold that it was designed to apply to damages arising from disputes between Admiral and its own employees, not between Admiral and another entity employing it. Admiral's relationship with AvMed, therefore, was not an 'employment relationship' under the Carolina Casualty policy, and the policy provides no coverage for the settlement amount paid by Admiral."

The choice of law decision did make a difference when considering the CGL policies, the panel found, as two issues were in dispute.

"The first is whether the CGL policies covered Admiral's settlement payment to AvMed," the court explained. "Whether the CGL policies provide coverage depends on whether the damages alleged by AvMed were 'damages because of . . . 'property damage.' If the CGL policies cover Admiral's claim, then a second question might turn on which state's law applies: whether the electronic-data exclusion applies to Admiral's attempt to recover its payments to AvMed. Both CGL policies exclude coverage for damages 'arising out of the loss of [or] loss of use of . . . electronic data.' Those two phrases may be ambiguous. If they are ambiguous, then the difference between Florida and Maryland law may determine whether Admiral's claim succeeds or fails."

Declining to attempt the fact-intensive determination of which state's law applied, the panel vacated judgment in favor of National Union and Continental and remanded the case for the district court to decide whether Florida or Maryland law should apply and whether, under the applicable state law, the CGL policies provide coverage for Admiral.

To read the per curiam opinion in Carolina Casualty Insurance Co. v. Red Coats, Inc., click here.