Last week, the federal District Court in Virginia issued a quasi security/data breach coverage case where the court concluded that making private medical records accessible online constituted a publication even though there was no evidence that a third party had accessed them. Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, LLC, No. 13-917, 2014 WL 3887797 (E.D. Va. Aug. 7, 2014). The mere fact that the records were accessible satisfied the plain and ordinary meaning of the term “publication” to implicate the duty to defend. What makes this decision noteworthy is how the Court distinguished the case before it from other decisions limiting the meaning of the term “publication.” Given that many healthcare providers are introducing “online” services for medical records, brokers and underwriters also may want to take note of this decision.
Portal Healthcare Solution (“Portal”) was a business specializing in the electronic safekeeping of medical records for hospitals, clinics, and other medical providers. Id. at *1. A New York putative class action was filed against it, alleging that Portal had failed to safeguard confidential medical records of patients at Glen Falls Hospital (“Glen Falls”), posting those records on the internet and causing them to become publicly accessible on the internet. Id. Two patients of Glen Falls discovered the breach when they ran a Google search of their names, and found links that directed them to their Glen Falls medical records. Id. at *2. (Honestly, how many of you are now going to Google your name? I did.)
Travelers issued two policies, each having slightly different language. One provided coverage for damages because of injury arising from (1) the “electronic publication of material that … gives unreasonable publicity to a person’s private life”; the other provided coverage for injury arising from the “electronic publication of material that … discloses information about a person’s private life.” Id. at *1.
Because the term “publication” was undefined in the policies, the court looked to dictionary definitions to ascertain its “plain and ordinary meaning.” Id. at *4. The Court concluded that the meaning of “publication” includes “to place before the public (as through a mess medium).” Id. The Court thereafter held that making the medical records accessible satisfied this meaning:
Exposing medical records to the online searching of a patient’s name, followed by a click on the first result, at least “potentially or arguably” places those records before the public. Any member of the public could retrieve the records of a Glen Falls patient, whether he or she was actively seeking those records or searching a patient’s name for other purposes, like a background check. Because medical records were placed before the public, the Court finds that Portal’s conduct falls within the plain meaning of “publication.”
Id. at *4.
The Insurer argued that there was no “publication” because there was no evidence that a third party had accessed or viewed the medical records at issue. Instead, the only evidence that existed was that the claimants themselves had accessed their own medical records. Id. The Court disagreed, analogizing the situation to displaying a book at Barnes & Nobel:
Publication occurs when information is “placed before the public,” not when a member of the public reads the information placed before it. By Travelers’ logic, a book that is bound and placed on the shelves of Barnes & Noble is not “published” until a customer takes the book off the shelf and reads it. Travelers’ understanding of the term “publication” does not comport with the term’s plain meaning, and the medical records were published the moment they became accessible to the public via an online search.
Id. at *5 (emphasis added).
The Court also distinguished the case before it from others. Creative Hospital Adventures, inc. v. U.S. Liab. Co., 444 Fed App’x 370 (11th Cir. 2011) and Whole Enchilada, Inc. v. Travelers Prop. Cas. Co. of Am., 581 F. Supp. 2d 677 (W.D. Pa. 2008) were distinguishable because there the information had been directly disclosed to a single person. In contrast, with the case before it, “the medical records were given not only to the patients but to anyone with a computer and internet access.” Id.
Recall Total Info. Mgmt., Inc. v. Federal Ins. Co.., 83 A.3d 664 (Conn. Ct. App. 2013) was distinguishable because in the case before it, “the information was posted on the internet and thus, was given not just to a single thief but to anyone with a computer and internet access.” Id. (As an aside, and as discussed in a prior issue of The Coverage Inkwell, the court in Recall Total also emphasized that there was no evidence that anyone had the ability to access the information in the lost media tapes – a very different factual scenario than the one represented in Portal Healthcare.)
What this case means. Placing information online constitutes a “publication,” whether or not there are assertions that a third party accessed the information. “Publication occurs when information is ‘placed before the public,’ not when a member of the public reads the information placed before it.” Admittedly, it’s hard to argue against the point, and other courts likely will reach similar conclusions. In my opinion, the real value of this decision is how the Court distinguished this case from other decisions that had held there was no publication without criticizing those decisions or calling them into question.
Questions are welcome.