Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

Columbia Casualty Co. v. Cottage Health System

United States District Court, C.D. California

May 7, 2015




         Plaintiff COLUMBIA CASUALTY COMPANY (hereinafter “Columbia”) by and through its attorneys, as and for Complaint against Defendant, hereby allege as follows:


         1. This is a Complaint for Declaratory Judgment pursuant to 28 U.S.C. § 2201 and for Reimbursement of Defense and Settlement Payments made by Columbia on behalf of its insured.

         2. This matter arises out of a data breach that resulted in the release of electronic private healthcare patient information stored on network servers owned, maintained and/or utilized by defendant COTTAGE HEALTH SYSTEM (“Cottage”).

         3. Cottage operates a network of hospitals located in Southern California, including Santa Barbara Cottage Hospital, Goleta Valley Cottage Hospital and Santa Ynez Valley Cottage Hospital (collectively, the “Hospitals.”)

         4. Following the data breach, a class action lawsuit was commenced against Cottage in which the plaintiffs asserted claims against Cottage and others based on its alleged breach of California's Confidentiality of Medical Information Act (“CMIA”), California Civil Code §56, et seq. A settlement has been reached in the class action lawsuit for the amount of $4.125 million.

         5. Columbia has agreed to fund the $4.125 million class action settlement, subject to a complete reservation of rights.

         6. The data breach is also the subject of an ongoing investigation conducted by the California Department of Justice regarding Cottage's potential violations of the federal Health Insurance Portability and Accountability Act (“HIPAA.”)

         7. Columbia issued a liability policy to Cottage providing claims made coverage for the October 1, 2013 to October 1, 2014 policy period.

         8. Columbia seeks a declaration that it is not obligated to provide Cottage with a defense or indemnification in connection with any and all claims stemming from the data breach at issue.

         9. Columbia also seeks a declaration of its entitlement to reimbursement in full from Cottage for any and all attorney's fees or related costs or expenses Columbia has paid or will pay in connection with the defense and settlement of the class action lawsuit and any related proceedings and an award of damages consistent with such declaration.


         10. Columbia is a corporation organized and existing under the laws of the State of Illinois and having its principal place of business located at CNA Plaza, Chicago, Illinois. Columbia is in the business of providing and underwriting insurance. Columbia is, and at all times relevant to this Complaint was, duly authorized to transact business in the State of California.

         11. Upon information and belief, Cottage is a California organization with its principal place of business located at 400 West Pueblo Street, Santa Barbara, California 93105.

         12. This litigation is a civil action over which this Court has original diversity jurisdiction pursuant to 28 U.S.C. §1332(a)(2) based on diversity of the parties and the amount in controversy.

         13. The amount in controversy in this matter exceeds $75, 000. Columbia seeks a declaration that it is not obligated to provide coverage to Cottage for any portion of a $4.125 million class action settlement, as well as additional potential regulatory liability.

         14. The insurance contract between Columbia and Cottage that is the subject of this declaratory judgment action was issued to Cottage in this District. Further, the alleged acts and omissions on the part of Cottage that precipitated the claims for which coverage is sought took place in this District. Therefore, venue is proper in this District pursuant to 28 U.S.C. § 1391.


         A. The Underlying Action

         15. On or about January 27, 2014, a proposed class action was commenced in California Superior Court, Orange County styled Kenneth Rice, et al. v. INSYNC, Cottage Health System, et al., Case No. 30-2014-00701147-CU-NP-CJC (the “Underlying Action”).

         16. The complaint alleges that between October 8, 2013 and December 2, 2013, confidential medical records of approximately 32, 500 of Cottage's Hospitals' patients that were stored electronically on Cottage's servers were disclosed to the public via the internet.

         17. The complaint alleges that the breach occurred because Cottage and/or its third-party vendor, INSYNC Computer Solution, Inc. (“INSYNC”), stored medical records on a system that was fully accessible to the internet but failed to install encryption or take other security measures to protect patient information from becoming available to anyone who “surfed” the internet.

         18. The complaint alleges that Cottage violated its nondelegable duties under CMIA and HIPAA to maintain the security of its patients' confidential medical records and to detect and prevent data breaches on its system that would allow such information to become available to the public through the internet.

         19. On or about December 24, 2014, the Court in the Underlying Action granted the class representative's motion for Preliminary Approval of Proposed Class Action Settlement. The proposed settlement involves creation of a $4.125 million settlement fund for payments to approximately 50, 917 Settlement class members, along with related expenses and attorneys' fees.

         20. Upon information and belief, INSYNC does not maintain sufficient liquid assets to contribute towards the proposed settlement fund and does not maintain liability insurance that applies with respect to the privacy claims asserted in the Underlying Action.

         21. Columbia has agreed to fund the $4.125 million settlement of the Underlying Action on behalf of Cottage, subject to a complete reservation of rights, including the right to seek reimbursement of any funds paid or advanced on Cottage's behalf pending a resolution of the instant coverage dispute.

         B. The California Department of Justice Investigation

         22. The data breach alleged in the Underlying Action is also the subject of a pending investigation by the California Department of Justice (“DOJ”) (the “DOJ Proceeding”). The DOJ Proceeding will determine whether Cottage complied with its obligations under HIPAA and any other pertinent state and federal laws and may potentially result in the imposition of fines, sanctions or penalties.

         C. The Columbia Policy

         23. Columbia issued a “NetProtect360” claims-made liability policy to Cottage in effect from October 1, 2013 through October 1, 2014, under policy number 425565140-02 (the “Columbia Policy”).

         24. As relevant here, the Columbia Policy provides coverage for Privacy Injury Claims and Privacy Regulation Proceedings with limits of $10, 000, 000 each claim or proceeding and $10, 000, 000 in the aggregate for all Claims - subject to a $100, 000 deductible (the “Columbia Policy.”) Coverage for Privacy Injury Claims is subject to a “Prior Acts” date of May 27, 2012.

         25. The Columbia Policy contains the following relevant Insuring Agreement provisions:

A. Insuring Agreements
If the insuring Agreement has been purchased, as indicated in the Declarations, the Insurer will pay on behalf of the Insured all sums in excess of the Deductible and up to the applicable limit of insurance that the Insured shall become legally obligated to pay:
* * *
2. Privacy Injury Liability
A. Privacy Injury ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.