The United States Court of Appeals for the Fourth Circuit recently affirmed a district court order, holding that a company’s allegedly improper disclosure of personal information was covered by its general liability policy even though no third parties accessed the data.

In the underlying action, plaintiffs alleged that medical records company Portal Healthcare negligently failed to secure a server containing confidential patient records.  Plaintiffs alleged that their records were available online for anyone to view without a password for over four months.  Portal filed a claim with its insurer, Travelers Indemnity Company of America, under a policy that covered electronic publication of materials containing information about a person’s private life.  When Travelers denied the claim, asserting that there was no covered publication at issue, Portal sued Travelers in district court. 

In August 2014, the district court held that Travelers had a duty to defend Portal because of the alleged publication of confidential patient data.  The court held that the publication occurred when “the records were placed before the public” and that publication does not require that any member of the public actually view the information.  The court based its opinion on the “Eight Corners rule,” examining the four corners of the underlying class action complaint and the four corners of the underlying insurance policies.   

The Fourth Circuit agreed, commending “the district court for its sound legal analysis,” and held that Travelers has a duty to defend Portal against the putative class action complaint.  The court rejected Travelers’ argument that “alternative dictionary definitions” of the term “publication” would absolve its duty to defend Portal.   

This decision is expected to be cited by other policyholders seeking coverage under traditional policies.  However, some courts have reached different conclusions in cases with similar factual circumstances.  For example, in Zurich Am. Ins. Co. v. Sony Corp. of America, 127 A.D.3d 662 (N.Y. App. Div. 1st Dep’t 2015), the New York state court granted summary judgment for the defendant, finding that the general liability policy did not apply where the publication was made by third parties.  Also, in Recall Total Information Management Inc. v. Federal Insurance Co., 115 A. 3d 458 (Conn. May 18, 2015), the Connecticut Supreme Court held that the loss of computer tapes that exposed personal information did not qualify as a “publication” under the general liability policy.   

In addition, policyholders should be aware that many new general liability policies contain cyber-exclusions.  Thus, policyholders should carefully weigh the option of purchasing separate cyber coverage. 

Troutman Sanders will continue to monitor this area of law.