United States District Court, C.D. California
MATTHEW T. WALSH, ESQ. CARROLL, MCNULTY & KULL LLC
ATTORNEYS FOR PLAINTIFF COLUMBIA CASUALTY COMPANY
COMPLAINT FOR DECLARATORY JUDGMENT AND REIMBURSEMENT
OF DEFENSE AND SETTLEMENT PAYMENTS
COLUMBIA CASUALTY COMPANY (hereinafter
“Columbia”) by and through its attorneys, as and
for Complaint against Defendant, hereby allege as follows:
is a Complaint for Declaratory Judgment pursuant to 28 U.S.C.
§ 2201 and for Reimbursement of Defense and Settlement
Payments made by Columbia on behalf of its insured.
matter arises out of a data breach that resulted in the
release of electronic private healthcare patient information
stored on network servers owned, maintained and/or utilized
by defendant COTTAGE HEALTH SYSTEM (“Cottage”).
Cottage operates a network of hospitals located in Southern
California, including Santa Barbara Cottage
Hospital, Goleta Valley Cottage Hospital and
Santa Ynez Valley Cottage Hospital (collectively,
Following the data breach, a class action lawsuit was
commenced against Cottage in which the plaintiffs asserted
claims against Cottage and others based on its alleged breach
of California's Confidentiality of Medical Information
Act (“CMIA”), California Civil Code §56,
et seq. A settlement has been reached in the class
action lawsuit for the amount of $4.125 million.
Columbia has agreed to fund the $4.125 million class action
settlement, subject to a complete reservation of rights.
data breach is also the subject of an ongoing investigation
conducted by the California Department of Justice regarding
Cottage's potential violations of the federal Health
Insurance Portability and Accountability Act
Columbia issued a liability policy to Cottage providing
claims made coverage for the October 1, 2013 to October 1,
2014 policy period.
Columbia seeks a declaration that it is not obligated to
provide Cottage with a defense or indemnification in
connection with any and all claims stemming from the data
breach at issue.
Columbia also seeks a declaration of its entitlement to
reimbursement in full from Cottage for any and all
attorney's fees or related costs or expenses Columbia has
paid or will pay in connection with the defense and
settlement of the class action lawsuit and any related
proceedings and an award of damages consistent with such
JURISDICTION AND VENUE
Columbia is a corporation organized and existing under the
laws of the State of Illinois and having its principal place
of business located at CNA Plaza, Chicago, Illinois. Columbia
is in the business of providing and underwriting insurance.
Columbia is, and at all times relevant to this Complaint was,
duly authorized to transact business in the State of
Upon information and belief, Cottage is a California
organization with its principal place of business located at
400 West Pueblo Street, Santa Barbara, California 93105.
This litigation is a civil action over which this Court has
original diversity jurisdiction pursuant to 28 U.S.C.
§1332(a)(2) based on diversity of the parties and the
amount in controversy.
amount in controversy in this matter exceeds $75, 000.
Columbia seeks a declaration that it is not obligated to
provide coverage to Cottage for any portion of a $4.125
million class action settlement, as well as additional
potential regulatory liability.
insurance contract between Columbia and Cottage that is the
subject of this declaratory judgment action was issued to
Cottage in this District. Further, the alleged acts and
omissions on the part of Cottage that precipitated the claims
for which coverage is sought took place in this District.
Therefore, venue is proper in this District pursuant to 28
U.S.C. § 1391.
The Underlying Action
or about January 27, 2014, a proposed class action was
commenced in California Superior Court, Orange County styled
Kenneth Rice, et al. v. INSYNC, Cottage Health System, et
al., Case No. 30-2014-00701147-CU-NP-CJC (the
complaint alleges that between October 8, 2013 and December
2, 2013, confidential medical records of approximately 32,
500 of Cottage's Hospitals' patients that were stored
electronically on Cottage's servers were disclosed to the
public via the internet.
complaint alleges that the breach occurred because Cottage
and/or its third-party vendor, INSYNC Computer Solution, Inc.
(“INSYNC”), stored medical records on a system
that was fully accessible to the internet but failed to
install encryption or take other security measures to protect
patient information from becoming available to anyone who
“surfed” the internet.
complaint alleges that Cottage violated its nondelegable
duties under CMIA and HIPAA to maintain the security of its
patients' confidential medical records and to detect and
prevent data breaches on its system that would allow such
information to become available to the public through the
or about December 24, 2014, the Court in the Underlying
Action granted the class representative's motion for
Preliminary Approval of Proposed Class Action Settlement. The
proposed settlement involves creation of a $4.125 million
settlement fund for payments to approximately 50, 917
Settlement class members, along with related expenses and
Upon information and belief, INSYNC does not maintain
sufficient liquid assets to contribute towards the proposed
settlement fund and does not maintain liability insurance
that applies with respect to the privacy claims asserted in
the Underlying Action.
Columbia has agreed to fund the $4.125 million settlement of
the Underlying Action on behalf of Cottage, subject to a
complete reservation of rights, including the right to seek
reimbursement of any funds paid or advanced on Cottage's
behalf pending a resolution of the instant coverage dispute.
The California Department of Justice
data breach alleged in the Underlying Action is also the
subject of a pending investigation by the California
Department of Justice (“DOJ”) (the “DOJ
Proceeding”). The DOJ Proceeding will determine whether
Cottage complied with its obligations under HIPAA and any
other pertinent state and federal laws and may potentially
result in the imposition of fines, sanctions or penalties.
The Columbia Policy
Columbia issued a “NetProtect360” claims-made
liability policy to Cottage in effect from October 1, 2013
through October 1, 2014, under policy number 425565140-02
(the “Columbia Policy”).
relevant here, the Columbia Policy provides coverage for
Privacy Injury Claims and Privacy Regulation Proceedings with
limits of $10, 000, 000 each claim or proceeding and $10,
000, 000 in the aggregate for all Claims - subject to a $100,
000 deductible (the “Columbia Policy.”) Coverage
for Privacy Injury Claims is subject to a “Prior
Acts” date of May 27, 2012.
Columbia Policy contains the following relevant Insuring
A. Insuring Agreements
If the insuring Agreement has been purchased, as indicated in
the Declarations, the Insurer will pay on behalf of the
Insured all sums in excess of the Deductible and up to the
applicable limit of insurance that the Insured shall become
legally obligated to pay:
* * *
2. Privacy Injury Liability
A. Privacy Injury ...