The Travelers Indemnity Company of America v. Portal Healthcare Solutions, LLC

Filing 33

MEMORANDUM OPINION and ORDER. Traveler's Motion for Summary Judgment is DENIED as to Traveler's duty to defend Portal in the underlying class action, Portal's Motion for Summary Judgment is GRANTED as to the duty to defend, and the Court DIRECTS Traverlers to provide a defense for Portal against the underlying class action. Signed by District Judge Gerald Bruce Lee on 8/7/2014. (rban, )

IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF VIRGINIA

ALEXANDRIA DIVISION
TRAVELERS INDEMNITY COMPANY OF

AMERICA,

Plaintiff,

Case No. l:13-cv-917 (GBL)

PORTAL HEALTHCARE SOLUTIONS, LLC
Defendant.
MEMORANDUM OPINION AND ORDER

THIS MATTER is before the Court on Plaintiff The Travelers Indemnity Company of
America's ("Travelers") and Defendant Portal Healthcare Solutions, LLC ("Portal")'s Cross-

Motions for Summary Judgment. (Docs. 20, 22). The parties dispute whether Travelers has a
duty to defend Portal against class-action allegations that Portal posted confidential medical
records on the internet, making the records available to anyone who searched for a patient's
name and clicked on the first result.

The issue before the Court is whether Portal's insurance policies with Travelers cover the

conduct alleged in the underlying class action. The Court holds that the insurance policies do
cover the conduct alleged because exposing confidential medical records to online searching is

"publication" giving "unreasonable publicity" to, or "disclosing]" information about, a person's
private life. Thus, Travelers has a duty to defend Portal against the underlying class action.
Accordingly, the Court DENIES Travelers' Motion for Summary Judgment and
GRANTS Portal's Motion for Summary Judgment.

I. BACKGROUND

This case involves two policies that Travelers issued to Portal covering the electronic

publication of certain materials. Travelers is an insurance provider and Portal is a business
specializing in the electronic safekeeping of medical records for hospitals, clinics, and other
medical providers. (See Doc. 1-4, at ^ 14.) Travelers issued to Portal two substantially identical
insurance policies (collectively the "Policies"): the first policy was effective from January 31,

2012 to January 31, 2013 (hereinafter the "2012 Policy"), and the second policy was effective
from January 31,2013 to January 31, 2014 (hereinafter the "2013 Policy").

The 2012 and 2013 Policies obligate Travelers to pay sums Portal becomes legally
obligated to pay as damages because of injury arising from (1) the "electronic publication of

material that ... gives unreasonable publicity to a person's private life" (the language found in
the 2012 Policy) or (2) the "electronic publication of material that... discloses information about
a person's private life" (the language found in the 2013 Policy). (See Doc. 1, at 5-6.)

On April 18, 2013, a class-action suit was filed in New York state court alleging that

Portal failed to safeguard the confidential medical records of patients at Glen Falls Hospital
("Glen Falls"), posting those records on the internet and causing those records to become
publicly accessible on the internet. (Doc. 1-4, H14.) Glen Falls had contracted with Portal for the
electronic storage and maintenance of its patients' confidential medical records, and either Glen

Falls or Portal contracted with Carpathia Hosting, Inc. to host those records on an electronic

server. (Id. ^ 16.) The class-action suit brings claims for negligence or gross negligence, breach
of warranty, breachof contract, and injunctive relief. (Id. ffl| 57-90).

Two patients of Glen Falls, Dara Halliday and Teresa Green, discovered that when they
conducted a "Google" search of their respective names, the first link that appeared was a direct

link to their respective Glen Falls medical records. (Id. fl 25, 29.) The class-action suit alleges
that patients' confidential medical records were accessible, viewable, copyable, printable, and

downloadable from the internet by unauthorized persons without security restriction from
November 2, 2012 to March 14, 2013. (Id. \ 39.)
On April 3, 2014, Travelers filed a Motion for Summary Judgment seeking a declaration

that it does not have a duty to defend Portal in the class action suit. (Doc. 20.) On the same day,
Portal also filed a Motion for Summary Judgment seeking an order compelling Travelers to
defend it against the underlying class action. (Doc. 22.)
II. STANDARD OF REVIEW

Under Federal Rule of Civil Procedure 56, the court must grant summary judgment if the
moving party demonstrates that there is no genuine issue as to any material fact, and that the

moving party is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(c).
In reviewing a motion for summary judgment, the court views the facts in the light most

favorable to the nonmoving party. Boitnott v. Corning, Inc., 669 F.3d 172, 175 (4th Cir. 2012)

(citing Anderson v. Liberty Lobby, Inc., All U.S. 242, 255 (1986)). Once a motion for summary
judgment is properly made and supported, the opposing party has the burden of showing that a
genuine dispute exists. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586-87
(1986). "[T]he mere existence of some alleged factual dispute between the parties will not defeat

an otherwise properly supported motion for summaryjudgment; the requirement is that there be
no genuine issue of material fact." Anderson, Ml U.S. at 247-48.

A "material fact" is a fact that might affect the outcome of a party's case. Id. at 248; JKC

Holding Co. v. Wash. Sports Ventures, Inc., 264 F. 3d 459, 465 (4th Cir. 2001). The materiality
of a fact is determined by the substantive law, and "[o]nly disputes over facts that might affect

the outcome of the suit under the governing law will properly preclude the entry of summary
judgment." Anderson, All U.S. at 248; Hooven-Lewis v. Caldera, 249 F. 3d 259, 265 (4th Cir.
2001).

A "genuine" issue concerning a "material" fact arises when the evidence is sufficient to

allow a reasonable jury to return a verdict in the nonmoving party's favor. Anderson, All U.S. at

248. Rule 56(e) requires the nonmoving party to go beyond the pleadings and by its own

affidavits, or by the depositions, answers to interrogatories, and admissions on file, designate
specific facts showing that there is a genuine issue for trial. Celotex Corp. v. Catrett, All U.S.
317,324(1986).
III. ANALYSIS

The Court GRANTS Portal's Motion for Summary Judgment and DENIES Travelers'

Motion for Summary Judgment because exposing confidential medical records to public online
searching placed highly sensitive, personal information before the public. Thus, the conduct falls

within the Policies' coverage for "publication" giving "unreasonable publicity" to, or
"disclosing]" information about, a person's private life, triggering Travelers' duty to defend.

In determining whether there is a duty to defend, the Court must follow the "Eight
Comers" Rule and look at the four comers of the underlying complaint and the four comers of
the underlying insurance policies. See Fuisz v. Selective Ins. Co., 61 F.3d 238, 242 (4th Cir.
1995) ("Determination of whether an insurer has a duty to defend requires examination of (1) the

policy language to ascertain the terms of the coverage and (2) the underlying complaint to
determine whether any claims alleged therein are covered by the policy."). Under Virginia law,

an insurer's duty to defend an insured "is broader than its obligation to pay" or indemnify an
insured. Brenner v. Lawyers Title Ins. Co. Corp., 397 S.E.2d 100, 102 (Va. 1990). As such, an

insurer has a duty to defend the insured so long as the complaint alleges grounds for liability

"potentially or arguably covered by the policy." Donnelly v. Transp. Ins. Co., 589 F.2d 761, 767
(4th Cir. 1978). Phrased in the negative, the duty to defend does not exist only where the

complaint clearly demonstrates no basis upon which the insurer could be required to indemnify
the insured. Reisen v. Aetna Life & Casualty Co., 302 S.E.2d 529, 531 (Va. 1983).
Nevertheless, any uncertainties regarding policy language must be construed in favor of

the insured. Fuisz, 61 F.3d at 242. It is the insurer's responsibility to use "language clear enough
to avoid any such ambiguity" if there are particular types of coverage that it does not want to

provide. St. Paul Fire & Marine Ins. Co. v. S.L. Nusbaum & Co., Inc., 316 S.E.2d 734, 736 (Va.
1984). Virginia law requires that "[w]hen an initial pleading 'alleges facts and circumstances,

some of which would, if proved, fall within the risk covered by the policy,' the insurance
company is obliged to defend its insured." Nationwide Mut. Ins. Co. v. Overlook, LLC, 785 F.

Supp. 2d 502, 531 (E.D. Va. 2011) (quoting Parker v. Hartford Fire Ins. Co., 278 S.E.2d 803,
804 (Va. 1981)).

Thus, under Virginia law, the question of whether the insurer has a duty to defend does
"not require the district courtto resolve factual questions at all. [Rather, it] need only decide such
coverage by comparing what [the plaintiff in the underlying suit] has alleged ... with the

language of the ... insurance policy." Penn-Am. Ins. Co. v. Coffey, 368 F.3d 409, 413 (4th Cir.

2004). Because the existence of the duty to defend is a pure question of law, the Court may
decide on summary judgment whether the class-action complaint alleges facts or circumstances
potentially or arguably covered by the Policies.

The Policies contain two relevant prerequisites to coverage. First, the Policies require an
electronic "publication" of material. Second, the 2012 and 2013 Policies respectively require that

the published material give "unreasonable publicity" to, or "disclose" information about, a
person's private life. Using this framework, the Court's analysis is divided into, first, an analysis
of how Portal's alleged conduct constitutes a "publication" of electronic material, and second, an
analysis of how the "publication" gave "unreasonable publicity" to, and "disclose[d]"
information about, patients' private lives.
A. Making confidential medical records publicly accessible via an internet search
does fall within the plain meaning of "publication."

First, the Court finds that exposing material to the online searching of a patient's name
does constitute a "publication" of electronic material, satisfying the Policies' first prerequisite to
coverage.

The term "publication" is not defined in the 2012 or 2013 Policies. Because the term is

undefined, "general rules of contract interpretation, and specifically insurance contract

interpretation, require" that the term "be given its plain and ordinary meaning." Solers, Inc. v.
m

Hartford Cas. Ins. Co., 146 F. Supp. 2d 785, 792 (E.D. Va. 2001). Virginia courts customarily
turn to dictionaries for help in deciphering a term's plain meaning. See e.g., Sheets v. Castle, 559

S.E.2d 616, 620 (Va. 2002) (turning to Black's Law Dictionary for the plain meaning of
"prevailing party"); Hubbard v. Henrico Ltd. P'ship, 497 S.E.2d 335, 340 (Va. 1998) (turning to

Webster's Third New International Dictionary for the plain meaning of "invoke"); Loudoun
Cnty. Dep't ofSocial Servs. v. Etzold, 425 S.E.2d 800, 802 (Va. 1993) (turning to Webster's New
International Dictionary for the plain meaning of "originate").

Here, Travelers has provided the Court with a definition of "publication" from Webster's

Third New International Dictionary as "to place before the public (as through a mass medium)."
(Doc. 21, at 11.) Exposing medical records to the online searching of a patient's name, followed

by a click on the first result, at least "potentially or arguably" places those records before the

public.1 Any member of the public could retrieve the records of a Glen Falls patient, whether he
or she was actively seeking those records or searching a patient's name for other purposes, like a
background check. Because medical records were placed before the public, the Court finds that

Portal's conduct falls within the plain meaning of "publication."2
Travelers raises two arguments for why Portal's conduct did not effect a "publication."
The Court finds neither argument persuasive. First, Travelers suggests that because "the entire
purpose of the services Portal provided was to keep the medical records private and

confidential," there cannot have been a publication. (Id. at 12.) But the issue cannot be whether

Portal intentionally exposed the records to public viewing since the definition of "publication"
does not hinge on the would-be publisher's intent. Rather, it hinges on whether the information

was placed before the public. Because an unintentional publication is still a publication, the
Court rejects Travelers' intent-based argument.

Travelers' second argument is that Portal's conduct did not effect a "publication" because
no third party is alleged to have viewed the information. (Id. at 12-13.) Rather, the patients

accessed their own records and only alleged that the information was available for view by a
third party. (Id.) But again, the issue is not whether a third party accessed the information
because the definition of "publication" does not hinge on third-party access.
Publication occurs when information is "placed before the public," not when a member of
the public reads the information placed before it. By Travelers' logic, a book that is bound and
placed on the shelves of Barnes & Noble is not "published" until a customer takes the book off

1See also 3 Patry on Copyright § 6:49 (2014) ("A key component of the definition of
publication is the term 'public,' since it is only distribution (or offering to distribute) to the
public that constitutes publication.").

2See also 18 Am. Jur. 2d Copyright andLiterary Property § 9 (2014) (citing "[a] 'general
publication' occurred when a work was made available to members ofthe public at large without
regard to their identity or what they intended to do with the work")

the shelf and reads it. Travelers' understanding of the term "publication" does not comport with
the term's plain meaning, and the medical records were published the moment they became

accessible to the public via an online search.3
Lastly, Travelers cites to nonbinding law distinguishable from the present case. Two of
the cases involve plaintiffs—and only the plaintiffs—being handed paper receipts bearing their

personal credit card information. See Creative Hospitality Ventures, Inc. v. U.S. Liability Ins.
Co., AAA F. App'x 370 (11th Cir. 2011); Whole Enchilada, Inc. v. Travelers Prop. Cas. Co. of

Am., 581 F. Supp. 2d 677 (W.D. Pa. 2008). These cases are distinguishable because, here, the

confidential medical records were not given to the patients directly but were posted publicly

online.4 Thus, the medical records were given not only to the patients but to anyone with a
computer and internet access.

Travelers cites to a third case involving the loss of computer tapes containing personal

data. See Recall Total Info. Mgmt. Inc. v. Fed. Ins. Co., 83 A.3d 664 (Ct. App. Conn. 2013).

Specifically, the computer tapes fell out of the back of a van, were taken by an unknown person,
and were never recovered. Id. at 667. This case is distinguishable because, here, the information

was posted on the internet and thus, was given not just to a single thief but to anyone with a
computer and internet access.

3Other District Judges within the Fourth Circuit have interpreted the term "publication"
similarly. See, e.g., State Farm Fire & Cas. Co. v. Franklin Ctr.for Gov't & Pub. Integrity, No.
l:13-cv-957, 2014 WL 1365758, at *5 (E.D. Va. Apr. 4, 2014) (stating that Black's Law
Dictionary defines "publisher" as "[o]ne who by himself or his agent makes a thing publicly
known."); Zurich Am. Ins. Co. v. Fieldstone Mortg Co., No. CCB-06-2055, 2007 WL 3268460,
at *5 (D. Md. Oct. 26, 2007) ("As the drafter of the policy, had [Plaintiff] wished to limit its
liability for coverage to the definition of 'publication,' it presumably could have done so; it did
not .... Of the circuits to examine 'publication' in the context of an 'advertising injury'
provision, the majority have found that the publication need not be to a third party.").

4See 50 Am. Jur. 2d Libel and Slander § 220 (2014) (citing to a Georgia state court
opinion finding that the operating of an internet website "published" statements for libel
purposes when he posted them on a website).

For these reasons, the Court finds that the facts and circumstances alleged in the class-

action complaint at least "potentially or arguably" constitute a "publication" within the meaning
of the Policies.

B. Posting confidential medical records online without security restriction gives
"unreasonable publicity" to, and "disclosure" of information about, patients'
private lives.

Next, the Court finds that the public availability of a patient's confidential medical
records gave "unreasonable publicity" to that patient's private life and "disclose[d]" information

about that patient's private life, satisfying the Policies' second prerequisite to coverage.
Here, Travelers provides a definition of "publicity" from Merriam Webster's Collegiate

Dictionary as "the quality or state of being obvious or exposed to the general view." (Doc. 21, at
19.) There can be no question that posting medical records online without security restriction
exposes the records to the general view and thus, gives the records "publicity" since, quite

literally, any member of the public can view, download, or copy those records.
Travelers argues that no "publicity" occurred when Portal posted the records because

"Portal did not take steps designed to attract public interest or gain public attention or support."

(Id. at 20 (emphasis added).) This argument focuses on the second definition of "publicity" as
"an act or device designed to attract public interest." (See id. at 19.) That, however, is only one
definition of "publicity." That Portal's conduct falls within the broader and primary definition of

"publicity" suffices to establish that Portal gave unreasonable publicity to patients' private lives
when it posted their medical records online without security restriction.

Travelers also provides a definition of "disclosure" from Black's Law Dictionary as
meaning "[t]he act or process of making known something that was previously unknown; a

revelation of facts." (Id. at 21.) Here, there can be no question that the unrestricted posting of

medical records on the internet made something known that previously had been unknown.

Specifically, it made medical records previously known only to the patient suddenly known to
the public at large.

Travelers argues that Portal's conduct did not "disclose" patients' private lives because

the patients in the class-action suit only viewed their own records and, of course, the patients
already had knowledge of those records. (Id.) However, under the plain meaning of "disclosure,"
the records were disclosed the moment they were posted publicly online, regardless of whether a

third party viewed them. Travelers' own definition of "disclosure" refers to the "[t]he act or
process of making known something that was previously unknown." (See id. (emphasis added)).
What Portal did by posting the records was engage in the process of making previously unknown
records suddenly known to the public at large.
For these reasons, the Court finds that the facts and circumstances alleged in the class-

action complaint gave "unreasonable publicity" to, and "disclose[d]" information about, patients'
private lives within the meaning of the Policies.
IV. CONCLUSION

For the reasons above, Travelers' Motion for Summary Judgment is DENIED as to

Traveler's duty to defend Portal in the underlying class action, Portal's Motion for Summary
Judgment is GRANTED as to the duty to defend, and the Court DIRECTS Travelers to provide a
defense for Portal against the underlying class action.
IT IS SO ORDERED.

ENTERED this I' day ofAugust, 2014.
Alexandria, Virginia

^

8/^ /2014

Gerald Bruce Lee

/§/

United States District Judge

10