Oral argument — Travelers Indemnity Company v. Portal Healthcare Solutions

Our next case this morning is Travelers Indemnity versus the Portal Healthcare Solutions. Mr. Brunstad, good to see you. Good to see you. Thank you, Your Honor. Eric Brunstad on behalf of Travelers. In the time that I have this morning, there are three key points I'd like to make. The first, I'd like to point out the key error that the district court made in characterizing the underlying state court complaint which issued this court review's de novo. The second is why the state court complaint does not allege publication as the policies require for it to trigger a duty to defend. And the third, that the state court complaint, why the state court complaint does not allege either unreasonable publicity or disclosure of information about a person's private life as the policies require also for there to be a duty to defend. Do you think you have resolved the jurisdictional point? Yes, Your Honor. We filed a stipulation, joint stipulation to amend the record to point out that at the time of filing, which for diversity purposes is the proper time to determine jurisdiction, that the principals of Portal, one was a resident of Virginia and the other two were foreign nationals. Travelers is a Connecticut corporation, so we have complete diversity for jurisdictional purposes. That's been stipulated to the amendment to the record has been filed. I don't believe it is in dispute. So I don't believe that there is a jurisdictional problem, Your Honor. You don't think there's anything else that needs to be done? No, Your Honor. We also submitted a letter to the court. So the record should be amended to state the jurisdictional facts. So it should be there as a matter of record. And we have informed the court by a letter as well of these facts. And I'm available to answer Your Honor's questions right now. I just want to make sure we had jurisdiction and the record's cleaned up. And you're satisfied it is? Yes, that was the purpose of doing the stipulation to amend the record under Rule 10 by agreement of the parties to state the jurisdictional facts. Do we have to enter an order or anything? Or do we just leave it alone the way it is? I don't believe under Rule 10 that Your Honor needs to enter an order. I believe it's sufficient upon stipulation of the parties to amend the record as we've done. Well, y'all were treating it as a corporation. Is that how it got in that posture? It is a corporation. That's a limited liability corporation, which I believe that under the precedence of this court, you would look to the citizenship of the members of the corporation. And because, as I've said, they are either a citizen of Virginia or international. That's what we know now. That's what we know now. And that was the state of affairs at the time the complaint was filed. And since the rule is the time of filing rule, I believe that the jurisdictional predicates are satisfied. Very good. Go ahead. Yes, Your Honor. The district court in multiple places characterized the underlying complaint, the underlying state court complaint, as alleging that there had been a posting of these confidential medical records on the internet. In five different places in the opinion, JA-116 is an example, posted the materials. They were placed on the internet. But that is not a fair or even reasonable characterization of the underlying complaint. If we look at the very first page of the state court complaint, the class action complaint, we see that the complaint itself states that this is a failure to safeguard case. These records were left potentially vulnerable to access. And I think it's important to understand what a server with this kind of information is. Essentially, a server with this kind of medical information is an electronic file cabinet. It was left unlocked. Someone doing a Google search could come in and access that information. And in fact, the underlying complaint alleges Ms. Halliday and Ms. Green actually did a Google search of their own name and were able to access their own information. That, however, does not equate to publication. The parties are in agreement that the definition of publication means to place before the public. Here, the insured did nothing to place. There was no affirmative act of placement or posting of any information to the public. There was no posting of information to the internet. That's not what the underlying complaint alleges. Counsel, I mean, as I read the district court, I thought the district court was quite careful in the words chosen, that the district court thought that the publication was the exposing of material to online searching. Do you agree that that happened, that material was exposed to online searching? It was vulnerable, Judge Harris. Okay, and so how is that not a publication? In what sense is it just a practical matter? Does that not put information in front of the public? Anyone with a computer now has access to that information. Yes, so suppose, using again the electronic file cabinet analogy, it's left unlocked. The fact that someone in the hospital can come up and look at that information doesn't mean that it's been published. I know you used the example of sort of leaving something on your desk before, this is like that, and I'm struggling with this because it is hard for me to think of, once you get outside kind of the Internet context of another way in which you could expose something to the entire public all at once by, say, leaving a file cabinet open. I mean, there really is no exact analog to this, is there? Every member of the public with a computer now has access to that information. That's not quite like leaving a file cabinet open. Well, but Judge Harris, I think it is in the following sense, and a critical sense. Suppose a nurse had left the patient's medical information on the desk. Any patient, anybody wandering through the hospital, could peek over and take a look at that. No one would say that that is publishing. She might have been negligent or he might have been negligent. But again, we're talking about like one or two people. You don't think it makes any difference that when you do it this way, literally everyone in the country now has access to that information. That seems different to me than the chance that one person might walk by. It is different in the sense of the degree of potential access, but it still does not constitute a publication, and here's why. A Google search is simply an extraction tool. There's no person at Google that reads the information. What you have to do is you have to affirmatively go in and try to take the information out. It's no different than the unlocked file cabinet. This is not like a book that's being published, where someone publishes a book and puts it on the bookshelf for people to come and look at. There was no placing before the public. As the Third Circuit said in One Beacon, Your Honor, publication requires dissemination to the public. That's what the Third Circuit held. There had been no dissemination to the public, therefore there was no publication. Here there was no dissemination. There was no affirmative act of dissemination. Think of it this way. This electronic file cabinet is sitting there, and true, if it's a real file cabinet, only one or two people might happen by and open it up and look at the inside. You say it has to be an intentional act of dissemination? It doesn't necessarily, Judge King, have to be an intentional act, but it has to be an act of some kind, and merely leaving something unprotected is not publication. If we again go back to the underlying complaint, because that is where our focus must be, we look at the allegations of the underlying complaint, because there's another dimension to this, Judge Harris, as well I'd like to explore. If we look at the underlying complaint, it simply alleges that Ms. Halliday and Ms. Green accessed their own information. There is no allegation in the record that Portal published this information to anybody else. Well, if someone else had accessed the information, your argument, I suppose, wouldn't change that there wasn't a publication because of the nature of the filing cabinet analogy that you've made. Is that right? Correct, Judge Harris, but it's two components to the analysis. There has to not only be an act of dissemination to meet the word publication, but there also has to be an audience, a public audience, not a private audience, and here there was only a private audience alleged in the underlying complaint. Ms. Halliday saw her own information. Ms. Green saw her own information. There is no allegation that Portal took this information and gave it to anybody else, or indeed that anybody else actually accessed the information. I feel that that's not the way I read the complaint. Can't you at least read the complaint a different way? Isn't it fair to read it? I just want to make sure I'm getting this right. So they say, Portal says, there's no evidence of access, downloads, third-party access, and then the plaintiffs say that statement's false. But the denial of no access is not an allegation of publication. Again, there's no allegation of affirmatively taking any stuff. I'm sorry, I feel like now we're mixing up two different arguments. I'm putting to one side the thing about publication, but I thought you were making a separate point that there's no allegation that anyone but the two plaintiffs in this case accessed this information, and I'm simply saying that's not how I read the complaint. So Your Honor, I believe, is focusing on paragraphs 41 and 42. The mere denial of the statement that no one accessed is also not an allegation that anybody in the public accessed somebody else's information. If one person says no one accessed it, and then the next person says that's false, I mean, aren't we kind of splitting hairs to say they're not saying somebody else accessed it? I think a fair construction of the entire complaint does not support Your Honor's reading, and for this very specific reason. It only specifically alleges Ms. Halliday and Ms. Green saw their own information. So when they say it's false that nobody accessed the information, well, it's true that Ms. Halliday and Ms. Green alleged that they did, but not anybody else. But even more importantly, Your Honor, we attach to the appendix A to our complaint, the state court's own characterization of the complaint before it in dismissing most of the complaints. The state court said the complaint does not allege an actual release of anything. That's key. There was no publication here because there was no release. There was no putting out. And I would urge the court to follow the Third Circuit's analysis in one beacon, where the court said in order for there to be publication, there must be dissemination, this affirmative act. But even if the court were to say there was publication, the policies require more. The policies require that the publication has to, you know, publicity. Publicity of private information must disclose it. Now, there cannot be any publicity unless we make known to somebody who doesn't know it before of this information. That is not stated in the underlying complaints. To disclose is even more requiring an affirmative act, an affirmative step to put something out there. And again, we don't have those allegations in the complaint. Again, the best analogy here is these are medical records. Assume the doctor left the chart, the medical chart, at the end of the bed. It might be negligence in some sense to leave someone's personal information on a chart at the end of the patient's bed in the hospital because anybody wandering around the hospital can come in and take a look at that information. But without the doctor or the nurse actually affirmatively putting that information in an inappropriate place, taking some affirmative act like putting it in the waiting room or announcing, here is personal private medical information. Take a look. We can't have a publication within the common meaning of the term publication. But isn't an unsecured server the equivalent of a public waiting room? It's just sitting there waiting for somebody to access. No, it's not, Your Honor, because the server is just like that electronic file cabinet, just like the file cabinet. You have to affirmatively go in and take the information. It doesn't matter. And to take is not the same thing as to publish. Well, you have to affirmatively walk into the waiting room and take the information. But under your scenario, that would be a publication. But that's only because the doctor or the nurse affirmatively put the information in an improper place, into a public forum, into the waiting room where people are building about where you wouldn't want to be. Isn't an unsecured server the equivalent of a public forum? No, it is the equivalent of the private file cabinet. It's like as an attorney, I have my private office. I have files on my desk. I leave the door unlocked. Perhaps I should not have left the door unlocked. But if someone walks into my office and they see those files, no one would say I published the information. If I took the files, however, and threw them out the window, and then they're lying on the street for people to view, then perhaps, arguably, I have published the information. But not where I've left them on my desk and someone has to affirmatively come in. But that's what a Google search requires. A Google search is an extraction tool. You go into the server. That's what the Google bots do. They go and they basically extract information. But extraction is not publication. Going in and taking something out of a private place where it's supposed to be is not publication by portal. Now, opposing counsel in their brief. Does the publication have to be by portal? I mean, this doesn't say that, as I understand it, the policy doesn't say that traveler will cover portal when portal publishes something. It's that travelers will cover portal if portal is liable for damages arising from a publication. It's in the passive voice. Portal doesn't have to do it. True. But at JA48, we have the language of the policy that in order for there to be a personal injury, it has to be a personal injury by portal. So what you're on with reading is language which fleshes out the definition of personal injury. But it has to be a personal injury by portal. If, in fact, first of all, let me make it clear. Google did not publish this information either. Again, Google is just an extraction tool. It's like a magnifying glass. You can go around and search and you can see things more clearly than you otherwise could. Google didn't publish any information. This isn't like Facebook where I can go and put a picture of my vacation on Facebook or I'm a proud parent. My child achieved some achievement on Facebook. Portal didn't do anything like that. It didn't take information, put it on its website. It didn't take any information and spread it out into the public. It just left its server unlocked so people could come in and extract the information. Google didn't take that information and publish it on Google's website. But even if it had, the policy doesn't cover apps by Google. It covers apps by Google. Maybe this is just a technology question, but it does seem like there's a bit of a mismatch. I would have thought that just sort of a common sense definition of publication, sort of the scope does matter. Something there has been a publication when every single member of the public now has access to the information. Every single member of the public now has access to this information. I don't know who exactly published it, but it's out there. So how is that not a publication? Because, Judge Harris, what that ties into, and this is important, and your intuition is not a bad one, what that means, though, is that there's access. And that is something which, of course, is reason for pause. The fact that so many people can have access is a consequence of the technology. But it doesn't change our definition of publication, which we have to use the common meaning definition of publication for purposes of the policy here. And publish, now there is another insurance policy they could have bought that they didn't, a cyber policy, that does cover failure to protect and would include something like access. But this policy only covers publication. For example, if you had an email, you crafted an email, and then you disseminated the email, you took an act, you hit the send button, and you disseminated the email to the public, that would be a publication of information. If that email contained private medical information, yes. But there is an affirmative act of publishing. Here, there is not. I understand Your Honor's concern about access by so many people, but access does not mean publication under any definition of the term publication. I've reserved time for rebuttal. Thank you very much. Thank you, Your Honors. Mr. Rasmussen? Thank you, Your Honor. May it please the Court, my name is John Rasmussen. I represent Portal Health Care Solutions today. This case addresses traveler's contractual duty to defend Portal against an underlying class action. In undersettled Virginia law, that duty hinges on the eight corners test. The eight corners test takes the four corners of the complaint and the four corners of the policy and compares them to determine whether there is a duty to defend. Here, the underlying complaint alleges an electronic publication. It alleges the unreasonable publicity of private lives, and it alleges the disclosure of private lives. Hence, travelers owe the duty to defend. That is especially so because of the unsettled Fourth Circuit and Virginia law. In Virginia, the duty to defend, any doubtness of the duty to defend, resolves in favor of the duty to defend. As the Supreme Court of Virginia said in Parker, if a complaint could lead to any covered judgment, Indeed, travelers in picking words, definitions of words to use to show what the plain meaning of publish and publication are, uses words that lead to a duty to defend here. Specifically, it uses the definition in Webster's New International Dictionary of publish, which means to place before a public forum. Place before the public is through a mass medium. I can't think of anything that would better describe Google than a mass medium or the Internet than a mass medium or to place something before the public as a mass medium. As Judge Harris noted, the complaint specifically alleges that any suggestion that this was not disclosed to others besides the plaintiffs is false. That's a specific allegation of the complaint and must be considered. Moreover, We have to take that as true? Yes. Especially under Parker and the Fuis case from this court. Well, I mean, the paragraphs that the appellant pointed to don't really expressly suggest that the records were accessed or downloaded by anyone other than the plaintiffs. It simply says in paragraph 42 that the notion that none of the aforementioned records were accessed or downloaded is false. That reasonably could be read to indicate that they were accessed or downloaded by the two individuals in this case. It could also be read, Your Honor, to extend beyond. In fact, the complaint specifically alleges in paragraph 63, which is on page 29 of the Joint Appendix, that the information was disclosed to others. So paragraphs F through H detail that. They make a big point, Travelers does, saying that this is a failure to adequately protect information. But just because Portho may have allegedly failed to protect information doesn't mean that failure to protect can also lead to a publication. In this case, the sharing of data on the Internet. As they agree, there is no intent requirement here. It requires an affirmative act, and the affirmative act was leaving the data in a place where it can be accessed by anybody in the country on the Internet. And this is in sharp contrast to the analogy they use. It's not like leaving it on a lawyer's desk in an office. A lawyer's desk is not a mass medium. It's not placing it before the general public. Judge Lee's analogy in the opinion below is more fitting. It's like taking a book and putting it on a shelf at Barnes & Noble. You can't say that's not published, but you're making it available to anybody that comes along to the bookshelf. There is some substantial discussion in the amicus brief about other kinds of policies that could have been bought here. Our contention is that those other policies are not the contractual terms that the parties have agreed to here. In fact, you can't look to what other policies may have applied. That's extrinsic evidence as to what the policies meant. Those aren't the terms that the parties have agreed to here. And whether there are cyber policies that exist, whether there are robust markets for them, don't matter because this isn't a cyber policy and it goes beyond the eight corners of the complaint. Also, there is some discussion of whether this was fairly priced based on the risk that the insurance company took on. There's no evidence in the record, and that also goes beyond the eight corners of the complaint and the policies issued here. Especially given Virginia's interpretive rules for deciding the duty to defend, coupled with the way that the eight corners test is applied in Virginia, I don't think there could be any question that the duty to defend attaches here. Can I ask you a question? Sure. How important is it to your argument that these medical records showed up as the first search result when you Googled the people? What if it had been the hundredth result? Would your argument be the same? I think that makes the argument stronger, that if it's the first hit, it's going to be available and noticeable. Right, but I'm just trying to figure out what happens if it's not. What if it's the 50th hit? Is that enough for publication? So if you really poke around and read all the screens, you might get these medical records, but you'd have to do a lot of work to get there? I think that could have a marginal effect on whether it was placed before the public. Well, that's what I'm asking. Where do we draw that line? I think there's no question here. It turns out it was the first hit. Got it, but we can't write an opinion that way, so where should we draw the line? I think the question would be, is it before a mass meeting? Is it available to the general public? If you have to go down 200 spots, it possibly might be not available to the general public, but it's not in the facts before the case. Is it more available if it's first? It's certainly much more noticeable if it's first. It's the very first hit. That's actually one of the issues. When you do a Google search, it doesn't go out and extract the information then. The information has already been extracted by Google bots and made part of an index so that it shows up when you do the search. The information has already been accessed by Google in order for you to access it through your own searches. Well, as I understood Judge Lee's analogy, if you place the hardcover book on the shelf of Barnes & Noble, the fact that no one picks it up doesn't mean that it's not been published, right? Correct, Your Honor. So I guess the fact that it might be more difficult to extract depending on the search engines used or the refinements of the search doesn't mean that the information still hasn't been published. Correct, Your Honor. That dovetails exactly with the definition of publish that's used by all the parties here, to place it before the public. The book is before the public. These records are before the public, and they're through a mass media. Those are the definitions used under Virginia blackletter law, the definitions used to help define what the plain meaning of publish is. I think opposing counsel has out-sufficiently listed a jurisdictional issue. We don't have any question about that. You agree with him? Yes, absolutely. Can you just tell me what's the status of the litigation in New York? What's going on in New York? I just asked that question. Discovery is proceeding, and there's been document discovery in some depositions. It's not. I think people are waiting to see what happens in this case before they litigate it more heavily. Unless Your Honor has any more questions on any of the issues, we respectfully ask that this court affirm the decision below, find that a duty to defend applies, and enter an appropriate overruling. Thank you, Mr. Raffnation. Thank you. Mr. Bruchstein. Thank you, Judge King. Judge Harris, I'd like to give another analogy that I hope will clarify even further. Suppose a celebrity checks into a hospital in Los Angeles, and the celebrity is there for a medical procedure, and that confidential health information is displayed on the celebrity's patient chart at the foot of the celebrity's bed. Someone from the National Enquirer comes into the hospital looking for this kind of information, and wanders into the hospital and sees this information at the foot of the bed, and then publishes it, broadcasts it to the whole world through this publication at every shopping market and supermarket place in the country, et cetera. Has the hospital published the information, even though it ends up being disseminated to the world? No, because leaving the chart at the foot of the bed is not an act of publication. Someone had to come into the hospital and extract that information. Was the nurse or the doctor or the hospital staff potentially negligent in allowing someone to wander in the room and take a look at the celebrity's information? Perhaps, yes, but that act of negligence, letting the guard down, does not mean that the hospital published the information. So here, instead of having that information stored on a chart at the foot of the bed, we have it stored in a computer, and we have that computer, the information, in what's supposed to be a locked file cabinet, electronic file cabinet. The fact that someone, the equivalent of walks into the hospital, using a Google search to extract that information, does not mean that Portal published the information, especially whereas here, the only two individuals alleged to have seen the information is Ms. Halliday and Ms. Green, who saw their own information. If we look at the cases, not only the one Beacon case that I focused on heavily during my initial presentation, but the other cases that we cite in our brief, like Whole Enchilada, a colorful name, we see that where someone is given their own information, whether it's on a credit card receipt or it's on some sort of a bit of paper that's given to them, or we see information that is extracted from them improperly, where you get your own information, that is not publication. First, let me run this hypothetical by you. Maybe this is different, and you can tell me if it is. Let's say the New York Times has a draft article on its server that's not yet ready for final publication, but something occurs with the server, accidentally unlocks the cabinet as you described it, and posts it to the website. Is that a publication? Well, no, Your Honor, but here's why. I guess I would take issue with the comment or the characterization of leaving the server unlocked as posting. The fact that it's in, it could be, for example, suppose I have a draft email in which I have confidential information, and it's sitting on my computer screen, but I haven't sent the email yet. You're not accepting his facts. I don't accept his, well, even, I don't accept the idea that leaving something on your... You've got to answer his question based on the facts that he included in it. No, I would say that's not a publication because the New York Times didn't affirmatively take a step yet to send it out to the... But it was all over the world. Yes, but only because someone came and extracted it. Someone came and took it. By the biggest newspaper in the world. One of the biggest, Your Honor. I'm not sure if they're still the biggest. They keep shrinking. First is my question. It's the biggest newspaper in the world, and it went all over the world. I still think the National Enquirer probably beats them out, Your Honor. They pushed the wrong button negligently. Now, yes, Your Honor, if they push the button... I thought he said what he said. I thought. Maybe I misheard it. Well, I described it as more of an accidental issue with the server that leads to the posting of the article on the website. But I thought you said that intent really doesn't matter. No, because you could do it accidentally. But you have to do something to actually disseminate the information. Well, this was an accident, but it ended up with a posting of an article. The accident can't simply be that we had the information in a cabinet that someone could access, or we accidentally had the information on our server. But I think if I understand correctly, Your Honor, it's hypothetical. If someone at the New York Times then took an affirmative act to broadcast the information, even though it's accidental, yes, that's a different case. That could be a publication. But we don't have that here. Just so I understand, because I'm really having trouble figuring out exactly the kind of boundaries that you're imagining. So what if someone did it on purpose? They did do it intentionally. In this case, they intentionally, whatever, unlocked your hypothetical file cabinet. They did it on purpose. They want this stuff out on the Internet. You'd still say that's not a publication because all they did was unlock the file cabinet so that the Google box could come in and get it. That's a more difficult case, Judge. Well, how come? It shouldn't be hard for you because you should still say there's no affirmative act. I still say there's no publication under that situation. Doesn't that seem sort of counterintuitive to you? No, but here's why. And no duty to defend. And no duty to defend, but for another reason. The policy doesn't cover intentional acts. You sell this policy with these revisions, and then you say you're not covered, and we don't even have to defend you. Well, Judge King. We don't get to coverage yet. We don't even have to defend you under these circumstances. Yes. Judge King, the policy doesn't cover intentional acts. And secondly, a different kind of a policy, cyber policy, would cover this thing fairly soon. A different kind of a policy. We're dealing with this policy. Correct, Judge King. He's right on that. We've got to just look at this policy. Correct, Judge King. It's hard enough for us. We've got to deal with one policy at a time. Actually, there are two here, but we've got to deal with ones that are in this case. Yes, Judge King. And the key difficulty here is defining the concept of publication. And we're in agreement. Both sides are in agreement that the term publication means to place before the public. Not the public comes in and takes the information, or someone comes in and takes their own information from a place where the information is supposed to be. And that, I think, Judge Harris, is the key to understanding the nuance with your last hypothetical. And that is, the information was in a place where it was supposed to be, without anyone in any way trying to push it out. Someone just left the cabinet unlocked. And leaving the cabinet unlocked does not meet the definition of publication, which we all agree means, at least the litigants agree, means to place before the public. But even if Your Honor might disagree with me on publication, we still have to get to the issues of unreasonable publicity or disclose information about a person's private life, those separate qualifications. I disagree with you on that. The second clauses seem to me, I mean, those phrases, they modify material, the material that went out. And they seem clearly to me just to be aimed at the fact that, look, if there has been a publication, it has to have been of something private. And there's no question here that this was private information. No, Judge Harris, and here's why. You've got red lights on, by the way. I'm sorry. May I answer? I just want to let him know it's on in case he missed me. May I answer the question? Sure. Thank you. On JA71, where we have the language of, we have the definition of a personal injury, these concepts are narrowing. They narrow the term of publication. It has to be private. It has to be a publication. If you publish the fact that I'm a lawyer, you know, there's nothing there. Yes. It has to be a publication that, for the 2013 policy, discloses information about a person's private life. Again, to disclose something is to make known to somebody who doesn't have that information before. Again, we're looking at common meanings of these terms. And disclose even more clearly, I submit, requires an affirmative act. The same thing for unreasonable publicity about a person's private life on JA51 for the 2012 policy requires, again, an affirmative act of putting that information out. And simply leaving the file cabinet unlocked doesn't qualify. So, for these reasons, we would ask that this court reverse the judgment of the district court in this case. Thank you very much, sir. Thank you very much. We'll come down to Boone Creek Council and then take up the next case. Thanks, guys.