Much has been made about the April 12 US Court of Appeals decision in Travelers vs Portal Healthcare Solutions where the court found that the Travelers Commercial General Liability policy (CGL) did not exclude coverage for data breach. Portal Healthcare had argued that it was required a defense by Travelers over the data breach suit of New York Hospital patients where the firm was hired to protect Hospital’s data.
The ruling only covered defense costs and was very specific to the set of circumstances in the Travelers CGL policy language exclusion. It would be wrong to generalize this finding to all CGL policies and to ignore the risks of having coverage gaps without Cyber Liability Insurance. Some CGL policies have specific exclusion language for this type issue, the Travelers policy did not.
Some attorneys and accountants have also argued that their malpractice insurance policy would also provide coverage with a Cyber Data Breach. This may or may not be true.
To hope that insurance policies where insurance carriers did not intend to cover certain exposures will put the firm in a position of having to fight not only the Data Breach but also your insurance carrier for coverage at a time the firm needs a quick response.
If the CGL policies and the Accountant and Attorney Malpractice policies are found by the courts to not exclude this coverage where the insurance carrier did not intended or charge for this exposure, you can be assured that policy language revisions will come quickly to address these issues.
A good Cyber/Data Breach policy has both 1st & 3rd party coverages. The defense costs and possibly the damages from a suit against the firm might cover the 3rd party issues from the CGL or malpractice policy. But there is likely no claims trigger in a CGL or a malpractice policy that will cover the 1st party costs that are now mandated by many states and jurisdictions.
This is likely not the final word on Cyber Data Breach coverage. Going without it may exposure your firm to damages that it may or may not be able to recover from is no coverage is found.