An appellate court agreed that “Travelers is duty bound under the Policies to defend Portal [Portal Healthcare Solutions, L.L.C.] against the class-action complaint”…that “alleges that Portal and others engaged in conduct that resulted in the plaintiffs’ private medical records being on the internet for more than four months.”  In the case of The Travelers Indemnity Company of America v. Portal Healthcare Solutions, L.L.C. on April 11, 2016 the 4th Circuit Court of Appeals affirmed the trial court denying Traveler’s claim for declaratory judgment that it did not have a duty to defend under it’s CGL policy:

…that it was required under Virginia law to “follow the ‘Eight Corners’ Rule” by looking to “the four corners of the underlying [class-action] complaint” and “the four corners of the underlying insurance policies” to determine whether Travelers is obliged to defend Portal.

This case has limited import in 2016 since this was an older CGL policy which did not include a cyber exclusion, which most policies do today.