Ruling less than three weeks after oral argument, the Fourth Circuit Court of Appeals on April 11, 2016 upheld a lower court’s ruling finding a duty on the part of Travelers to defend a class action lawsuit alleging a data breach by Portal Health Care Solutions, LLC ("Portal"). A 2013 class action had been filed against Portal and others alleging that plaintiffs’ private medical records had been made publicly available on the internet for more than four months. Three months after the class action was filed, Travelers sued Portal for a declaratory judgment in federal court in Virginia, seeking a declaration that it was not obligated under Commercial General Liability ("CGL") policies to defend Portal. The ground asserted by Travelers was that the class action complaint failed to allege a covered "publication" by Portal, a requirement under the CGL’s Coverage Part B - Personal and Advertising Injury.
In 2014, the District Court had earlier determined that under Virginia’s eight-corner rule, which required consideration only of the allegations of the Complaint and the content of the policy, the Complaint alleged grounds for liability which were potentially or arguably covered by the policy. Travelers Indemnity Company of America v. Portal Health Care Solutions, LLC, 35 F.Supp.2d 765 (E.D.Va. 2014). The CGL policies at issue required for coverage a) an electronic “publication” of material, and b) that the material give “unreasonable publicity” to or “disclose” information about one's private life. The lower court found that exposing material online, which could be reached just by searching the patient’s name constituted a “publication” of electronic material, as the information had been placed before the public even absent proof the material was actually viewed.
On appeal, the Fourth Circuit deferred largely to the reasoning of the lower court and its application of Virginia's eight-corner rule. The Fourth Circuit reminded that the duty to defend the insured is broader than the duty to indemnify the insured, and left the question of indemnification for another day. The Fourth Circuit ruling is at odds with at least two state court rulings, which found no coverage for cyber claims in traditional commercial insurance policies. However, these issues continue to evolve in state and federal courts around the country as companies deal with differing theories of liability for data breaches.