Last week, the federal District Court in Virginia issued a quasi security/data breach coverage case where the court concluded that making private medical records accessible online constituted a publication even though there was no evidence that a third party had accessed them. Travelers Indem. Co. of Am. v. Portal Healthcare Solutions, LLC, No. 13-917, 2014 WL 3887797 (E.D. Va. Aug. 7, 2014). The mere fact that the records were accessible satisfied the plain and ordinary meaning of the term “publication” to implicate the duty to defend. What makes this decision noteworthy is how the Court distinguished the case before it from other decisions limiting the meaning of the term “publication.” Given that many healthcare providers are introducing “online” services for medical records, brokers and underwriters also may want to take note of this decision.
Portal Healthcare Solution (“Portal”) was a business specializing in the electronic safekeeping of medical records for hospitals, clinics, and other medical providers. Id. at *1. A New York putative class action was filed against it, alleging that Portal had failed to safeguard confidential medical records of patients at Glen Falls Hospital (“Glen Falls”), posting those records on the internet and causing them to become publicly accessible on the internet. Id. Two patients of Glen Falls discovered the breach when they ran a Google search of their names, and found links that directed them to their Glen Falls medical records. Id. at *2. (Honestly, how many of you are now going to Google your name? I did.)