Travelers Indemnity Co. of America v. Portal Healthcare Solutions, LLC

35 F. Supp. 3d 765, 2014 WL 3887797, 2014 U.S. Dist. LEXIS 110987

• Court: District Court, E.D. Virginia
• Decided: August 7, 2014
• Docket: Case No. 1:13-cv-917 (GBL)
• Status: Published

Opinion

MEMORANDUM OPINION AND ORDER

GERALD BRUCE LEE, District Judge.

THIS MATTER is before the Court on Plaintiff The Travelers Indemnity Company of America’s (“Travelers”) and Defendant Portal Healthcare Solutions, LLC (“Portal”)’s Cross-Motions for Summary Judgment. (Docs. 20, 22). The parties dispute whether Travelers has a duty to defend Portal against class-action allegations that Portal posted confidential medical records on the internet, making the records available to anyone who searched for a patient’s name and clicked on the first result.

The issue before the ■ Court is whether Portal’s insurance policies with Travelers cover the conduct alleged in the underlying class action. The Court holds that the insurance policies do cover the conduct alleged because exposing confidential medical records to online searching is “publication” giving “unreasonable publicity” to, or “disclosing]” information about, a person’s private life. Thus, Travelers has a duty to defend Portal against the underlying class action.

Accordingly, the Court DENIES Travelers’ Motion for Summary Judgment and GRANTS Portal’s Motion for Summary Judgment.

I. BACKGROUND

This case involves two policies that Travelers issued to Portal covering the electronic publication of certain materials. Travelers is an insurance provider and Portal is a business specializing in the electronic safekeeping of medical records for hospitals, climes, and other medical providers. (See Doc. 1-4, at ¶ 14.) Travelers issued to Portal two substantially identical insurance policies (collectively the “Policies”): the first policy was effective from January 31, 2012 to January 31, 2013 (hereinafter the “2012 Policy”), and the second policy was effective from January 31, 2013 to January 31, 2014 (hereinafter the “2013 Policy”).

The 2012 and 2013 Policies obligate Travelers to pay sums Portal becomes legally obligated to pay as damages because of injury arising from (1) the “electronic publication of material that ... gives unreasonable publicity to a person’s private life” (the language found in the 2012 Policy) or (2) the “electronic publication of material that ... discloses information about a person’s private life” (the language found in the 2013 Policy). (See Doc. 1, at 5-6.)

On April 18, 2013, a class-action suit was filed in New York state court alleging that Portal failed to safeguard the confidential medical records of patients at Glen Falls Hospital (“Glen Falls”), posting those records on the internet and causing those records to become publicly accessible on the internet. (Doc. 1-4, ¶ 14.) Glen Falls had contracted with Portal for the electronic storage and maintenance of its patients’ confidential medical records, and either Glen Falls or Portal contracted with Carpathia Hosting, Inc. to host those records on an electronic server. (Id. ¶ 16.) The class-action suit brings claims for negligence or gross negligence, breach of warranty, breach of contract, and injunctive relief. (Id. ¶¶ 57-90).

Two patients of Glen Falls, Dara Halli-day and Teresa Green, discovered that when they conducted a “Google” search of their respective names, the first link that appeared was a direct link to their respective Glen Falls medical records. (Id. ¶¶ 25, 29.) The class-action suit alleges that patients’ confidential medical records were accessible, viewable, copyable, printable, and downloadable from the internet by unauthorized persons without security restriction from November 2, 2012 to March 14, 2013. (Id. ¶ 39.)

On April 3, 2014, Travelers filed a Motion for Summary Judgment seeking a declaration that it does not have a duty to defend Portal in the class action suit. (Doc. 20.) On the same day, Portal also filed a Motion for Summary Judgment seeking an order compelling Travelers to defend it against the underlying class action. (Doc. 22.)

II. STANDARD OF REVIEW

Under Federal Rule of Civil Procedure 56, the court must grant summary judgment if the moving party demonstrates that there is no genuine issue as to any material fact, and that the moving party is entitled to judgment as a matter of law. Fed.R.Civ.P. 56(c).

In reviewing a motion for summary judgment, the court views the facts in the light most favorable to the nonmoving party. Boitnott v. Corning, Inc., 669 F.3d 172, 175 (4th Cir.2012) (citing Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 255, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986)). Once a motion for summary judgment is properly made and supported, the opposing party has the burden of showing that a genuine dispute exists. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586-87, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986). “[T]he mere existence of some alleged factual dispute between the parties will not defeat an otherwise properly supported motion for summary judgment; the requirement is that there be no genuine issue of material fact.” Anderson, 477 U.S. at 247-48, 106 S.Ct. 2505.

A “material fact” is a fact that might affect the outcome of a party’s case. Id. at 248, 106 S.Ct. 2505; JKC Holding Co. v. Wash. Sports Ventures, Inc., 264 F.3d 459, 465 (4th Cir.2001). The materiality of a fact is determined by the substantive law, and “[ojnly disputes over facts that might affect the outcome of the suit under the governing law will properly preclude the entry of summary judgment.” Anderson, 477 U.S. at 248, 106 S.Ct. 2505; Hooven-Lewis v. Caldera, 249 F.3d 259, 265 (4th Cir.2001).

A “genuine” issue concerning a “material” fact arises when the evidence is sufficient to allow a reasonable jury to return a verdict in the nonmoving party’s favor. Anderson, 477 U.S. at 248, 106 S.Ct. 2505. Rule 56(e) requires the nonmoving party to go beyond the pleadings and by its own affidavits, or by the depositions, answers to interrogatories, and admissions on file, designate specific facts showing that there is a genuine issue for trial. Celotex Corp. v. Catrett, 477 U.S. 317, 324, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986).

III. ANALYSIS

The Court GRANTS Portal’s Motion for Summary Judgment and DENIES Travelers’ Motion for Summary Judgment because exposing confidential medical records to public online searching placed highly sensitive, personal information before the public. Thus, the conduct falls within the Policies’ coverage for “publication” giving “unreasonable publicity” to, or “disclosing]” information about, a person’s private life, triggering Travelers’ duty to defend.

In determining whether there is a duty to defend, the Court must follow the “Eight Corners” Rule and look at the four corners of the underlying complaint and the four corners of the underlying insurance policies. See Fuisz v. Selective Ins. Co., 61 F.3d 238, 242 (4th Cir.1995) (“Determination of whether an insurer has a duty to defend requires examination of (1) the policy language to ascertain the terms of the coverage and (2) the underlying complaint to determine whether any claims alleged therein are covered by the policy.”). Under Virginia law, an insurer’s duty to defend an insured “is broader than its obligation to pay” or indemnify an insured. Brenner v. Lawyers Title Ins. Corp., 240 Va. 185, 397 S.E.2d 100, 102 (1990). As such, an insurer has a duty to defend the insured so long as the complaint alleges grounds for liability “potentially or arguably covered by the policy.” Donnelly v. Transp. Ins. Co., 589 F.2d 761, 767 (4th Cir.1978). Phrased in the negative, the duty to defend does not exist only where the complaint clearly demonstrates no basis upon which the insurer could be required to indemnify the insured. Reisen v. Aetna Life & Casualty Co., 225 Va. 327, 302 S.E.2d 529, 531 (1983).

Nevertheless, any uncertainties regarding policy language must be construed in favor of 'the insured. Fuisz, 61 F.3d at 242. It is the insurer’s responsibility to use “language clear enough to avoid any such ambiguity” if there are particular types of coverage that it does not want to provide. St. Paul Fire & Marine Ins. Co. v. S.L. Nusbaum & Co., Inc., 227 Va. 407, 316 S.E.2d 734, 736 (1984). Virginia law requires that “[w]hen an initial pleading ‘alleges facts and circumstances, some of which would, if proved, fall within the risk covered by the policy,’ the insurance company is obliged to defend its insured.” Nationwide Mut. Ins. Co. v. Overlook, LLC, 785 F.Supp.2d 502, 531 (E.D.Va. 2011) (quoting Parker v. Hartford Fire Ins. Co., 222 Va. 33, 278 S.E.2d 803, 804 (1981)).

Thus, under Virginia law, the question of whether the insurer has a duty to defend does “not require the district court to resolve factual questions at all. [Rather, it] need only decide such coverage by comparing what [the plaintiff in the underlying suit] has alleged ... with the language of the ... insurance policy.” Penn-Am. Ins. Co. v. Coffey, 368 F.3d 409, 413 (4th Cir.2004). Because the existence of the duly to defend is a pure question of law, the Court may decide on summary judgment whether the class-action complaint alleges facts or circumstances potentially or arguably covered by the Policies.

The Policies contain two relevant prerequisites to coverage. First, the Policies require an electronic “publication” of material. Second, the 2012 and 2013 Policies respectively require that the published material give “unreasonable publicity” to, or “disclose” information about, a person’s private life. Using this framework, the Court’s analysis is divided into, first, an analysis of how Portal’s alleged conduct constitutes a “publication” of electronic material, and second, an analysis of how the “publication” gave “unreasonable publicity” to, and “disclose[d]” information about, patients’ private lives.

A. Making confidential medical records publicly accessible via an internet search does fall within the plain meaning of “publication.”

First, the Court finds that exposing material to the online searching of a patient’s name does constitute a “publication” of electronic material, satisfying the Policies’ first prerequisite to coverage.

The term “publication” is not defined in the 2012 or 2013 Policies. Because the term is undefined, “general rules of contract interpretation, and specifically insurance, contract interpretation, require” that the term “be given its plain and ordinary meaning.” Solers, Inc. v. Hartford Cas. Ins. Co., 146 F.Supp.2d 785, 792 (E.D.Va.2001). Virginia courts customarily turn to dictionaries for help in deciphering a term’s plain meaning. See e.g., Sheets v. Castle, 263 Va. 407, 559 S.E.2d 616, 620 (2002) (turning to Black’s Law Dictionary for the plain meaning of “prevailing party”); Hubbard v. Henrico Ltd. P’ship, 255 Va. 335, 497 S.E.2d 335, 338 (1998) (turning to Webster’s Third New International Dictionary for the plain meaning of “invoke”); Loudoun Cnty. Dep’t of Social Servs. v. Etzold, 245 Va. 80, 425 S.E.2d 800, 802 (1993) (turning to Webster’s New International Dictionary for the plain meaning of “originate”).

Here, Travelers has provided the Court with a definition of “publication” from Webster’s Third New International Dictionary as “to place before the public (as through a mass medium).” (Doc. 21, at 11.) Exposing medical records to the online searching of a patient’s name, followed by a click on the first result, at least “potentially or arguably” places those records before the public.¹ Any member of the public could retrieve the records of a Glen Falls patient, whether he or she was actively seeking those records or searching a patient’s name for other purposes, like a background check. Because medical records were placed before the public, the Court finds that Portal’s conduct falls within the plain meaning of “publication.”²

Travelers raises two arguments for why Portal’s conduct did not effect a “publication.” The Court finds neither argument persuasive. First, Travelers suggests that because “the entire purpose of the services Portal provided was to keep the medical records private and confidential,” there cannot have been a publication. (Id. at 12.) But the issue cannot be whether Portal intentionally exposed the records to public viewing since the definition of “publication” does not hinge on the would-be publisher’s intent. Rather, it hinges on whether the information was placed before the public. Because an unintentional publication is still a publication, the Court rejects Travelers’ intent-based argument.

Travelers’ second argument is that Portal’s conduct did not effect a “publication” because no third party is alleged to have viewed the information. (Id. at 12-13.) Rather, the patients accessed their own records and only alleged that the information was available for view by a third party. (Id.) But again, the issue is not whether a third party accessed the information because the definition of “publication” does not hinge on third-party access.

Publication occurs when information is “placed before the public,” not when a member of the public reads the information placed before it. By Travelers’ logic, a book that is bound and placed on the shelves of Barnes & Noble is not “published” until a customer takes the book off the shelf and reads it. Travelers’ understanding of the term “publication” does not comport with the term’s plain meaning, and the medical records were published the moment they became accessible to the public via an online search.³

Lastly, Travelers cites to nonbinding law distinguishable from the present case. Two of the eases involve plaintiffs — and only the plaintiffs — being handed paper receipts bearing their personal credit card information. See Creative Hospitality Ventures, Inc. v. U.S. Liability Ins. Co., 444 Fed.Appx. 370 (11th Cir.2011); Whole Enchilada, Inc. v. Travelers Prop. Cas. Co. of Am., 581 F.Supp.2d 677 (W.D.Pa.2008). These cases are distinguishable because, here, the confidential medical records were not given to the patients directly but were posted publicly online.⁴ Thus, the medical records were given not only to the patients but to anyone with a computer and internet access.

Travelers cites to a third case involving the loss of computer tapes containing personal data. See Recall Total Info. Mgmt. Inc. v. Fed. Ins. Co., 147 Conn.App. 450, 83 A.3d 664 (2013). Specifically, the computer tapes fell out of the back of a van, were taken by an unknown person, and were never recovered. Id. at 667. This case is distinguishable because, here, the information was posted on the internet and thus, was given not just to a single thief but to anyone with a computer and internet access.

For these reasons, the Court finds that the facts and circumstances alleged in the class-action complaint at least “potentially or arguably” constitute a “publication” within the meaning of the Policies.

B. Posting confidential medical records online without security restriction gives “unreasonable publicity” to, and “disclosure” of information about, patients’ private lives.

Next, the Court finds that the public availability of a patient’s confidential medical records gave “unreasonable publicity” to that patient’s private life and “disclose[d]” information about that patient’s private life, satisfying the Policies’ second prerequisite to coverage.

Here, Travelers provides a definition of “publicity” from' Merriam Webster’s Collegiate Dictionary as “the quality or state of being obvious or exposed to the general view.” (Doc. 21, at 19.) There can be no question that posting medical records online without security restriction exposes the records to the general view and thus, gives the records “publicity” since, quite literally, any member of the public can view, download, or copy those records.

Travelers argues that no “publicity” occurred when Portal posted the records because “Portal did not take steps designed to attract public interest or gain public attention or support.” (Id. at 20 (emphasis added).) This argument focuses on the second definition of “publicity” as “an act or device designed to attract public interest.” (See id. at 19.) That, however, is only one definition of “publicity.” That Portal’s conduct falls within the broader and primary definition of “publicity” suffices to establish that Portal gave unreasonable publicity to patients’ private lives when it posted their medical records online without security restriction.

Travelers also provides a definition of “disclosure” from Black’s Law Dictionary as meaning “[t]he act or process of making known something that was previously unknown; a revelation of facts.” (Id. at 21.) Here, there can be no question that the unrestricted posting of medical records on the internet made something known that previously had been unknown. Specifically, it made medical records previously known only to the patient suddenly known to the public at large.

Travelers argues that Portal’s conduct did not “disclose” patients’ private lives because the patients in the class-action suit only viewed their own records and, of course, the patients already had knowledge of those records. (Id.) However, under the plain meaning of “disclosure,” the records were disclosed the moment they were posted publicly online, regardless of whether a third party viewed them. Travelers’ own definition of “disclosure” refers to the “[t]he act or process of making known something that was previously unknown.” (See id. (emphasis added)). What Portal did by posting the records was engage in the process of making previously unknown records suddenly known to the public at large.

For these reasons, the Court finds that the facts and circumstances alleged in the class-action complaint gave “unreasonable publicity” to, and “disclose[d]” information about, patients’ private lives within the meaning of the Policies.

IV. CONCLUSION

For the reasons above, Travelers’ Motion for Summary Judgment is DENIED as to Traveler’s duty to defend Portal in the underlying class action, Portal’s Motion for Summary Judgment is GRANTED as to the duty to defend, and the Court DIRECTS Travelers to provide a defense for Portal against the underlying class action.

IT IS SO ORDERED.

1 . See also 3 Patry on Copyright § 6:49 (2014) ("A key component of the definition of publication is the term ‘public,’ since it is only distribution (or offering to distribute) to the public that constitutes publication.”).

2 . See also 18 Am.Jur.2d Copyright and Literary Property § 9 (2014) (citing "[a] 'general publication’ occurred when a work was made available to members of the public at large without regard to their identity or what they intended to do with the work”)

3 . Other District Judges within the Fourth Circuit have interpreted the term "publication” similarly. See, e.g., State Farm Fire & Cas. Co. v. Franklin Ctr. for Gov't & Pub. Integrity, No. 1:13-cv-957, 2014 WL 1365758, at *5 (E.D.Va. Apr. 4, 2014) (stating that Black’s Law Dictionary defines “publisher” as "[o]ne who by himself or his agent makes a thing publicly known.”); Zurich Am. Ins. Co. v. Fieldstone Mortg. Co., No. CCB-06-2055, 2007 WL 3268460, at *5 (D.Md. Oct. 26, 2007) ("As the drafter of the policy, had [Plaintiff] wished to limit its liability for coverage to the definition of ‘publication,’ it presumably could have done so; it did not.... Of the circuits to examine ‘publication’ in the context of an ‘advertising injury’ provision, the majority have found that the publication need not be to a third party.”).

4 . See 50 Am.Jur.2d Libel and Slander § 220 (2014) (citing to a Georgia state court opinion finding that the operating of an internet website "published” statements for libel purposes when he posted them on a website).