In Travelers Indemnity Co. of Am. v. Portal Healthcare Solutions, L.L.C., No. 14-1944 (4th Cir. Apr. 11, 2016) the Fourth Circuit affirmed a ruling that an insurance company had an obligation to defend a policyholder against allegations that the policyholder negligently allowed private individual medical records to be viewed publicly on the internet for more than four months.  The policyholder argued that it was entitled to insurance coverage under two CGL policies issued by Travelers, which provided coverage for sums that Portal became legally obligated to pay as damages for the “electronic publication of material that ... gives unreasonable publicity to a person’s private life” and the “electronic publication of material that ... discloses information about a person’s private life.”  Despite arguments by the insurance company that exposing customer data on the internet was not a covered “publication,” the Fourth Circuit held that the exposure was at least arguably a publication under the plain language of the contract, and there was a duty to defend.  Importantly, the policy at issue did not include any of the recent restrictions on coverage adopted through the Insurance Services Office purporting to bar coverage for data breaches.