On October 7, 2013, the United States District Court for the Central District of California in Hartford Casualty Insurance Co. v. Corcino & Associates, CV 13-03728-GAF (C.D. Cal. Oct. 7, 2013), held that a general liability policy covered data breach claims alleging violations of California patients’ right to medical privacy. The court rejected the insurer’s contention that coverage was negated by an exclusion for liabilities resulting from a violation rights created by state or federal acts. The decision also rejected an attempt commonly made by insurers to of exclude coverage for statutory penalties.
Background
In 2012, a group of patients brought suit against Stanford Hospital and Clinics (“Stanford”) and Corcino and Associates (“Corcino”) after confidential medical information was posted on a public website. The lawsuit claims that private information and medical records of 20,000 patients entrusted to Stanford and Corcino were posted online by a Corcino job applicant without the patients’ consent. The patients sued Stanford and Corcino, alleging violations of the plaintiffs’ constitutional right of privacy, breach of the plaintiffs’ common law privacy rights, and violation of California’s Confidentiality of Medical Information Act (“CMIA”) and the Lanterman-Petris-Short Act (“LPS”). Corcino tendered the privacy lawsuit to its general liability insurer, Hartford Casualty Insurance Company (“Hartford”), seeking a defense and indemnification. Hartford accepted the defense under a reservation of rights, but sought to escape coverage by contending that the claims were precluded by an exclusion for violations of statutorily created rights.
While the privacy lawsuit was pending in state court, Hartford commenced a declaratory judgment action in the US District Court for the Central District of California seeking a declaration of no coverage. Hartford asserted that the exclusion in the parties’ CGL policy precluded coverage for damages caused by “personal and advertising injury” arising out of the violation of a person’s right to privacy “created by any state or federal act.”
Holdings
The California federal court rejected Hartford’s contention that the policy’s statutory exclusion barred coverage for statutory damages arising out of the alleged privacy violations. The court emphasized that courts should interpret insurance coverage provisions broadly, and coverage exclusions narrowly and against the insurer, so as to afford the greatest possible protection to the policyholder. Applying these rules of construction, the court read the plain language of the policy’s statutory exclusion as barring coverage only for violations of privacy rights that were “created by” statute. The court distinguished the plaintiffs’ privacy claims from such statutorily created rights, explaining that the plaintiffs’ right to privacy existed under California common law long before the enactment of California’s CMIA and LPS statutes. Therefore, because a cause of action for the violation of a right to medical privacy would have been available to the plaintiffs even without the privacy statutes, the exclusion did not apply to bar coverage.
The court also rejected Hartford’s reliance on an exclusion for statutory penalties. The court reasoned that the CMIA and LPS statutes merely created new statutory remedies as incentives for plaintiffs toenforce their already existing common law and constitutional rights. The court concluded, therefore, that while amounts paid for violation of the statutes might be labeled as “statutory penalties,” such amounts were nevertheless “damages” due to “personal and advertising injury” and, thus, they would be covered under the policy.
Implications
Corcino & Associates confirms the general rule that policy exclusions are to be read narrowly and in favor of coverage.The decision also shows that data breach and other privacy violations should be covered under general liability insurance, and stands as the latest among a line of cases affording coverage for amounts paid as statutory penalties where those amounts are paid because of the injury sustained by the plaintiff.
