The insurer had a duty to defend the insured contractor's publication of medical records online, making them accessible to anyone. Travelers Indem. Co. of Am. v. Portal Heathcare Solutions, LLC, 2014 U.S. Dist. 110987 (E.D. Va. Aug. 7, 2014).
Portal specialized in safekeeping of medical records for hospitals, clinics, and other medical providers. Portal was sued in a class action suit filed in New York state court for failing to safeguard the confidential medical records of patients at Glen Falls Hospital. Two patients of Glen Falls conducted a Google search of their respective names, and found a direct link to their Glen Falls medical records.
Travelers provided policies to Portal in 2012 and 2013, obligating Travelers to cover damages because of injury arising from (1) the "electronic publication of material that . . . gives unreasonable publicity to a person's private life" (the 2012 policy) or (2) the "electronic publication of material that . . . disclosed information about a person's private life" (the 2013 policy).
In the coverage action, both parties filed motions for summary judgment on Travelers' duty to defend. The court granted summary judgment to Portal because exposing confidential medical records to public online placed highly sensitive, personal information before the public.
The court first determined that exposing material to the online searching of a patient's name constituted a "publication" of electronic material. Travelers argued Portal's conduct did not effect a "publication." Because Portal was to keep the medical records private, there was no publication. But the issue was not whether Portal intentionally exposed the records to public viewing since the definition of "publication" did not hinge on the would-be publisher's intent. Rather, it hinged on whether the information was placed before the public.
Travelers also argued that no "publication" occurred because no third party was alleged to have viewed the information. But again, the issue was not whether a third party accessed the information because the definition of "publication" did not hinge on third-party access.
Next, the court found that the public availability of a patient's confidential medical records gave "unreasonable publicity" to that patient's private life and "disclosed" information about that patient's private life, satisfying the policies' second prerequisite to coverage.What Portal did by posting the records was engage in the process of making previously unknown records suddenly known to the public at large.
