See All Posts

May 04, 2016

Posting medical records online is a “publication” under a CGL policy

Making confidential patient records available online was an “electronic publication” under the terms of a CGL policy. Travelers Indem. Co. of America v. Portal Healthcare Solutions, LLC, No. 14-1944, 2016 WL 1399517 (4th Cir. April 11, 2016). The insured, Portal, electronically stores and manages patient personal information for hospitals and clinics. After googling their own names, a group of patients noticed that their medical records from a specific clinic were available online without any security restrictions. A class-action was filed against Portal by the clinic’s patients. Portal’s insurer, Travelers, filed a declaratory judgment action asserting it had no duty to defend Portal. Travelers’ insurance policies covered Portal for damages because of an injury arising from the “electronic publication of material that…gives unreasonable publicity to a person’s private life” (2012 version of the policy) or “electronic publication of material that…discloses information about a person’s private life” (2013 policy). The 4th Circuit upheld the district court’s finding that the policies covered Portal because the plaintiffs’ complaint that Portal exposed their personal information to an unsecured online search that anyone could undertake constituted an “electronic publication.” The court also found that the public availability of the patients’ confidential personal information gave “unreasonable publicity” to the plaintiffs’ private lives. It should be noted that this decision did not analyze what damages, if any, the plaintiffs allegedly suffered due to the exposure of their private information; such information would be important to an analysis of Travelers’ ultimate duty to indemnify Portal.