Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Editor's Note: This post is a joint submission with BakerHostetler's <a href="http://www.classactionlawsuitdefense.com/">Class Action Lawsuit Defense</a> blog.
On October 7, 2013, a federal district court in California held that the Advertising Injury coverage in a comprehensive general liability policy issued by Hartford Casualty Insurance Company (Hartford) covered two class action lawsuits arising out of the disclosure of confidential health information. <a href="http://www.classactionlawsuitdefense.com/files/2013/10/10-9-2013-post-cal.pdf">Hartford Casualty Insurance Company v. Corcino &amp; Associates et al., CV 13-3728 GAF (JCx), United States District Court Central District (October 7, 2013)</a>.
Hartford insured Corcino &amp; Associates (Corcino), a technology consultant, under a comprehensive general liability policy. The policy provided personal and advertising injury coverage, pursuant to which Hartford agreed to pay for damages because of "electronic publication of material that violates a person's right of privacy." Personal and advertising injury "[a]rising out of the violation of a person&rsquo;s right to privacy created by any state or federal act" is excluded from coverage. By its terms, the exclusion &ldquo;does not apply to liability for damages that the insured would have in the absence of such state or federal act.&rdquo;
Corcino, along with Stanford Hospital and Clinics (Stanford) and others, was sued in two class action lawsuits, following the disclosure of confidential medical information. The plaintiffs in those cases alleged that &ldquo;the private, confidential, and sensitive medical and/or psychiatric information of almost 20,000 patients of Stanford&rsquo;s Emergency Department appeared on a public website and remained publicly available online for almost one full year." Stanford had provided that data to Corcino, which in turn gave it to a job applicant to work with in order to evaluate his suitability for employment. The applicant posted the data on a public website called "Student of Fortune," a tutorial marketplace for students, seeking assistance with converting the data as requested by Stanford. The data remained on the website for almost a year, until it was discovered by one of the plaintiffs.
The plaintiffs asserted various claims, including violations of their constitutional right of privacy, common law privacy rights and of California Civil Code sections 56.36 et seq., California&rsquo;s Confidentiality of Medical Information Act (CMIA) and California Welfare &amp; Institutions Code sections 5330 et seq., known as the Laterman Petris Short Act (LPS). The plaintiffs in both class actions survived the defendants&rsquo; demurrers, with the trial courts ruling that the alleged facts supported their claims for statutory damages as well as their constitutional and common law claims.
Hartford brought a declaratory judgment action against Corcino, Stamford and others, alleging that the statutory relief exclusion in the personal and advertising injury provision barred coverage for the class action claims. Stanford and Corcino filed a motion to dismiss, contending that the rights at issue have long been recognized under the common law and that the creation of new statutory remedies for violation of those rights do not bring the claims within the statutory relief exclusion. The court agreed.
The court stated, &ldquo;the right to medical privacy at issue in the Underlying Litigation was not created under either of the two statutes under which the plaintiffs seek relief. Since at least 1931, California has recognized both a constitutional privacy right a common law tort cause of action for violations of the right to privacy. . . . Although courts have expressly recognized a constitutional right of privacy with respect to medical records since at least 1979, medical records have been considered private and confidential for well over 100 years at common law.&rdquo; Because the CMIA and the LPS did not create new privacy rights, but instead codified existing rights and created effective remedies to encourage enforcement, &ldquo;the relief sought under these statutes can reasonably be interpreted to fall outside of Hartford&rsquo;s Policy exclusion.&rdquo;
While a potentially important decision in California, the precedential value of this decision outside of California may be limited, however, due to California&rsquo;s unique history with regard to its relatively early recognition of privacy rights in its common law.

California Court Finds Advertising Injury Coverage is Triggered by Medical Information Data Breach