Monthly Archives: August 2014

Medical Records, The Internet, and A “Publication”


This entry was posted by on .

Last week, the federal District Court in Virginia issued a quasi security/data breach coverage case where the court concluded that making private medical records accessible online constituted a publication even though there was no evidence that a third party had accessed them.  Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, LLC, No. 13-917, 2014 WL 3887797 (E.D. Va. Aug. 7, 2014).  The mere fact that the records were accessible satisfied the plain and ordinary meaning of the term “publication” to implicate the duty to defend.  What makes this decision noteworthy is how the Court distinguished the case before it from other decisions limiting the meaning of the term “publication.”  Given that many healthcare providers are introducing “online” services for medical records, brokers and underwriters also may want to take note of this decision. 

Portal Healthcare Solution (“Portal”) was a business specializing in the electronic safekeeping of medical records for hospitals, clinics, and other medical providers.  Id. at *1.  A New York putative class action was filed against it, alleging that Portal had failed to safeguard confidential medical records of patients at Glen Falls Hospital (“Glen Falls”), posting those records on the internet and causing them to become publicly accessible on the internet.  Id.  Two patients of Glen Falls discovered the breach when they ran a Google search of their names, and found links that directed them to their Glen Falls medical records.  Id. at *2.  (Honestly, how many of you are now going to Google your name?  I did.) 

Travelers issued two policies, each having slightly different language.  One provided coverage for damages because of injury arising from (1) the “electronic publication of material that … gives unreasonable publicity to a person’s private life”; the other provided coverage for injury arising from the “electronic publication of material that … discloses information about a person’s private life.”  Id. at *1. 

Because the term “publication” was undefined in the policies, the court looked to dictionary definitions to ascertain its “plain and ordinary meaning.”  Id. at *4.  The Court concluded that the meaning of “publication” includes “to place before the public (as through a mess medium).”  Id.  The Court thereafter held that making the medical records accessible satisfied this meaning:

Exposing medical records to the online searching of a patient’s name, followed by a click on the first result, at least “potentially or arguably” places those records before the public.  Any member of the public could retrieve the records of a Glen Falls patient, whether he or she was actively seeking those records or searching a patient’s name for other purposes, like a background check.  Because medical records were placed before the public, the Court finds that Portal’s conduct falls within the plain meaning of “publication.”

Id. at *4.       

The Insurer argued that there was no “publication” because there was no evidence that a third party had accessed or viewed the medical records at issue.   Instead, the only evidence that existed was that the claimants themselves had accessed their own medical records.  Id.  The Court disagreed, analogizing the situation to displaying a book at Barnes & Nobel: 

Publication occurs when information is “placed before the public,” not when a member of the public reads the information placed before it.  By Travelers’ logic, a book that is bound and placed on the shelves of Barnes & Noble is not “published” until a customer takes the book off the shelf and reads it.  Travelers’ understanding of the term “publication” does not comport with the term’s plain meaning, and the medical records were published the moment they became accessible to the public via an online search. 

Id. at *5 (emphasis added).

The Court also distinguished the case before it from others.  Creative Hospital Adventures, inc. v. U.S. Liab. Co., 444 Fed App’x 370 (11th Cir. 2011) and Whole Enchilada, Inc. v. Travelers Prop. Cas. Co. of Am., 581 F. Supp. 2d 677 (W.D. Pa. 2008) were distinguishable because there the information had been directly disclosed to a single person. In contrast, with the case before it, “the medical records were given not only to the patients but to anyone with a computer and internet access.”  Id.

Recall Total Info. Mgmt., Inc. v. Federal Ins. Co.., 83 A.3d 664 (Conn. Ct. App. 2013) was distinguishable because in the case before it, “the information was posted on the internet and thus, was given not just to a single thief but to anyone with a computer and internet access.”  Id.  (As an aside, and as discussed in a prior issue of The Coverage Inkwell, the court in Recall Total also emphasized that there was no evidence that anyone had the ability to access the information in the lost media tapes – a very different factual scenario than the one represented in Portal Healthcare.) 

What this case means.  Placing information online constitutes a “publication,” whether or not there are assertions that a third party accessed the information.  “Publication occurs when information is ‘placed before the public,’ not when a member of the public reads the information placed before it.”  Admittedly, it’s hard to argue against the point, and other courts likely will reach similar conclusions.  In my opinion, the real value of this decision is how the Court distinguished this case from other decisions that had held there was no publication without criticizing those decisions or calling them into question. 

Questions are welcome.

This entry was posted in Data Breach Insurance Coverage, Privacy Rights, Uncategorized and tagged .

Are “Right of Privacy” and “Person” Ambiguous? New York Weighs In


This entry was posted by on .

Last week, I vacationed in beautiful Cooperstown, NY, where I watched baseball in stadiums built to resemble early 20th century ballparks, visited the Baseball Hall of Fame, and enjoyed scenic views of the green Catskill Mountains.  Oh, and there’s the Ommegang brewery, too.  During that week, I was totally free of daily faxes promoting low-budget roof repairs, instant credit for business loans, and vacation hideaways in Cancun.  So, what a return to reality it was to see Tower National Ins. Co. v. National Business Capital, Inc., No. 155786/2012, 2014 WL 3728500 (N.Y. Supr. Ct. July 28, 2014), a case addressing the meaning of “right of privacy” in the context of blast faxes.  Thanks (or maybe not) to Roberta Anderson at K&L Gates for bringing this case to my attention as I returned back to the 21st century.

The underlying lawsuit was a putative class action seeking damages for National Business Capital’s (“NBC”) alleged blast faxing in violation of the TCPA and Connecticut’s version of the statute.  NBC sought coverage under its CGL policy for “personal and advertising injury” under “[o]ral or written publication, in any nature, of material that violates a person’s right of privacy.”  Id. at *1-2.  The issue was one of first impression in New York.  (NBC also contended that the underlying action alleged “property damage,” but the court held that the complaint did not allege an “occurrence” to implicate coverage under Coverage A.  Id. at *4.)

Tower National argued that the phrase “the right of privacy” in the definition for “personal and advertising injury” means rights of secrecy only, and does not contemplate the right of seclusion to implicate coverage for TCPA litigation.  Id. at *5.  The insurer also argued that “to the extent privacy includes that right of seclusion, the right to privacy would not include fax blasting since it is not the type of intrusion that ‘would be highly offensive to a reasonable person’” under the Restatement (Second) of Torts, §652.  Id.

 The court disagreed.  Citing dictionary definitions, the New York trial court held that, at best, the term “privacy” was ambiguous and included rights to seclusion.  Thus, the TCPA lawsuit implicated coverage under the policy:

 The term privacy is ordinarily understood to mean “seclusion or isolation from the view of, or contact of others.”  Webster New College Dictionary 880 (2001).  Black’s Law Dictionary 1325 (7th ed. 1999) defines the right of privacy as “the right to personal autonomy” or “the right of a person and the person’s property to be free from unwarranted public scrutiny or exposure.” Here, given that the phrase “right of privacy” is susceptible to at least two reasonable interpretations, the court finds that the phrase is ambiguous and thus must be construed in favor of coverage. . . . Accordingly, the court finds that “privacy right” includes the injury alleged in the underlying action resulting from NBC’s sending of unsolicited faxes in alleged violation of the TCPA and the Connecticut statute.

 Id. at *5.

 The court also rejected the argument that the context of the right of privacy offense in the definition for “personal and advertising injury” restricted the meaning of “privacy” to rights of secrecy.  Id. at *6.  Noting the definition for “personal and advertising injury” includes numerous torts within the enumerated offenses, the court concluded that the phrase “right of privacy” referred to the tort for “invasion of the right of privacy,” which includes the right to seclusion.

 Finally, the court distinguished the case before it from the New York appellate court’s recent decision in Sports Specialties, Inc. v. Twin City Ins. Co., 116 A.D.3d 1270 (N.Y.A.D. 2014), which had held that the phrase “right of privacy” was limited to natural persons and did not include the rights of corporations.  Here, the trial court held that the “right of privacy” applied to both persons and companies.

 The New York trial court rejected the reasoning in Sports Specialties that use of the term “person,” coupled with the omission of the term “organization,” in the “right of privacy” offense signaled that the policy only contemplated an individual’s right of privacy.  Id. at *7-8.  The court based its reasoning on the observation that “with the exception of the wrongful eviction or invasion of the occupancy offense, which refers to a person, the other clauses in the provision either omit any reference to a person or organization or use the term ‘another.’”  Id.

 According to the trial court, the Sports Specialties decision was not based on the omission of the term “organization,” but instead on the nature of the claims asserted against plaintiff.  In doing so, the trial court noted the following observation by the appellate division:  “[a]lthough parties debate whether [the umbrella] policy draws as clear a distinction between the terms at issue, this issue need not detain us because plaintiff’s actions—tortious interference with contract and business relations, unfair and deceptive trade practices and misappropriation of trade secrets—do not constitute a violation of ‘person’s right of privacy’ within the meaning of [the subject policies].”  Id. at *7.  That this observation by the appellate only had applied to one of the policies before it, however, did not seem to matter to the trial court.

 Finally, the trial court also noted that the “right of privacy” offense in the CGL policy at issue in Sports Specialties had been “sandwiched between two other offenses … that make express reference to misdeeds perpetrated against either a person or an organization.”  Id.  That was not the case in the policy before it:

 [W]hile the clause before the violation of privacy offense, relating to libel and disparagement refers to an organization and a person, the following clause does not and, instead, refers to “the use of another’s advertising idea in your advertising.”  The next clause similarly refers to “[i]nfringing on another’s copyright, trade dress or slogan in ‘your advertisement.’” 

Id.  The court also noted that the underlying class likely contained individuals as well.  Id.

What does this case mean?  For now, New York has joined the collection of states holding that TCPA litigation implicates “personal and advertising injury” coverage.  The court’s use of the common law tort for “invasion of privacy” to broaden the meaning of “privacy” to include rights of seclusion is interesting considering that New York does not recognize the common law invasion of privacy.

However, the court’s conclusion that the term “person” is ambiguous to broaden coverage to privacy rights held by companies likely is suspect.  For one, the court’s reasoning now makes terms such as “your” and “organization” within the definition for “personal and advertising injury” superfluous.  (Never mind that the term “your” is defined in the preamble to Section I of CGL policies.)  In addition, the court’s focus on the appellate division’s isolated remark in Sports Specialties unjustly limits the decision.  And its observation that the putative class members potentially included individuals arguably makes the court’s entire analysis of the issue moot.

This entry was posted in Privacy Rights, Uncategorized.