Nossaman Infrastructure Partner, Donna Brady, just published a blog about the need for cyber insurance for those in the transportation industry in light of the increasing use of intelligent transportation systems. A department of transportation might not be the first thing that pops into your head when you think of data breaches, but anyone connected to the Internet is a potential target. A transportation agency will have consumer payment information, GPS vehicle tracking information, and could be a target for ransomware because of the great need to maintain operations and to comply with privacy laws. For these reasons, transportation agencies are attractive targets to cyber criminals. It is a good reminder that the evolving use of intelligent systems and the Internet of Things requires an evaluation of your insurance portfolio, whether you are in the transportation industry or not.
Can an excess carrier go ahead and fund an excess primary limits settlement and then assert a claim for bad faith against the primary insurer who previously refused to accept and fund a prior in-limits policy demand? On August 5, a Court of Appeal in Ace American Ins. Co. v. Fireman’s Fund Ins. Co., Case No. B264861 (Cal. Ct. App. Aug. 5, 2016) held that such claims may be asserted by the excess carrier even without an excess judgment—a settlement will do. This is a good development for policyholders, as it will encourage settlements by providing those with claims against carriers more options to resolve their disputes.
The facts of the case are fairly straightforward. The plaintiff in the underlying case was badly injured during a special effects accident on a film set. He sued Warner Brothers, who tendered the defense to its primary carrier Fireman’s Fund, which issued Warner Brothers both a primary and umbrella policy. During the litigation, plaintiff offered to settle multiple times within policy limits of the Fireman’s Fund policies. It was later alleged that Fireman’s Fund “failed and/or refused to pay” those settlement demands. The parties ultimately settled for significantly more than the primary policy, requiring the excess insurer above the Fireman’s Fund Umbrella, Ace American, to fund part of the settlement.
Ace American then secured an assignment of rights from the insured and filed a lawsuit for equitable subrogation and breach of the covenant of good faith and fair dealing against Fireman’s Fund. After all, the only reason it had to pay any part of the settlement was Fireman’s Fund’s refusal to accept the in-limits demand. But this was where the conflicting law came into play. Fireman’s Fund argued on demurrer that without an excess judgment, it could not be sued for bad faith or equitable subrogation.
Before Ace American, there were two decisions within the Second District Court of Appeal that had similar facts, but completely opposite outcomes. Ace American pointed to Fortman v. Safeco Ins. Co. (1990) 221 Cal.App.3d 1394, where the Court held that equitable subrogation claims against a primary insurer could progress even with just a settlement. Fireman’s Fund relied on RLI Ins. Co. v. CNA Casualty of California (2006) 141 Cal.App.75, where the Court held that an excess judgment was required before a suit for equitable subrogation would lie against a primary insurer, relying on earlier California Supreme Court decisions Hamilton v. Maryland Casualty Co. (2002) 27 Cal.4th 718, and Isaacson v. California Ins. Guaranty Assn. (1988) 44 Cal.3d 775.
The trial court agreed with Fireman’s Fund and sustained its demurrer without leave to amend, but the Court of Appeal reversed. It was an extensive opinion that analyzed over a dozen opinions in this area, both in and out of California. The Court rejected RLI, finding it misinterpreted the Supreme Court’s holding in Hamilton, where the Court had determined that a stipulated settlement with a covenant not to execute was not binding on the insurer as to damages suffered by an insured as a result of a contract breach. Instead the Ace American court relied on the holding in Fortman, where the court held that a breach of contract and bad faith case is actionable even without an excess judgment, so long as the excess insurer can show it actually paid an amount in excess of the primary insurer’s limits.
There is an evident conflict between the Court of Appeal divisions in the Second Appellate District which perhaps the California Supreme Court might address if this decision is further appealed. We prefer the approach taken by the Ace American court, which allows more options for the insured. In fact, the Court expressly recognized the importance of this ruling to policyholders when it stated, “Moreover, our decision protects insureds, because insurers whose mishandling of settlement offers causes damages will be liable for the losses they cause.” A ruling to the contrary would permit insurers to play fast and loose in early settlement negotiations, forcing the insured or an excess carrier to contribute to a settlement, and then be insulated from a contribution or later breach of contract and bad faith action if the case settles before judgment.
In an effort to deal with the terrible epidemic of drug abuse and the human and economic costs of this dilemma, the state of West Virginia has brought lawsuits in several jurisdictions against pharmaceutical companies and distributors of “controlled” drugs which West Virginia alleges were sold by “pill mills” to people for no reasonable or legitimate purpose. The sale of those controlled drugs, the state alleges, led to terrible addiction and related bodily injury to its citizens, which in turn caused enormous financial losses to the state in the form of medical care spent on its its injured citizens.
Naturally enough, the pharmaceutical companies are turning to their commercial general liability policies for a defense against these costly claims. In two different states, Illinois and Florida, the trial courts both agreed with liability insurers that they did not have to cover the lawsuits as they did not seek damages “because of bodily injury,” notwithstanding the allegations to that effect by West Virginia in the respective lawsuits.
Oddly, the Florida court in Travelers Property Casualty Co. et al v Anda Inc. found the very explicit bodily injury allegations in the underlying lawsuit were only there for “context.” Because of that, the judge agreed with Travelers’ overreaching argument that there was no ‘occurrence,” that distributing the medications for financial benefit “is the antithesis of an accident.” We doubt whether this same judge would find no accident where the claim was by a consumer of a product who claimed injury, notwithstanding that the distributor of the allegedly defective product was doing so for financial gain. The decision is pending on appeal in the 11th Circuit Court of Appeals.
Luckily the 7th Circuit Court of Appeals recently reversed the lower court ruling in the decision in Cincinnati Insurance Company v H.D. Smith. Although the facts were incredibly similar to the Anda case, the 7th Circuit found that West Virginia’s claims against the insured in that matter were indeed potentially covered and must be defended. The Court relied on the point that the insurance policy stated that “Cincinnati agreed to cover damages that H.D. Smith became legally obligated to pay ‘because of bodily injury,’” and that “damages because of bodily injury include ‘damages claimed by any person or organization or care, loss of services or death resulting at any time from the bodily injury.’” Comparing these provisions in the policy to the allegations of the complaint filed by the state of West Virginia, and applying the classic doctrine that a mere potential for coverage is all that is required to find a duty to defend, the Court spent only a few pages in concluding that the insurer owed a defense. There, the court focused on the “because of” language noting that this creates a broader coverage than a promise to cover only “damages for bodily injury.” Acknowledging that the West Virginia suit alleged many theories and remedies, the Court also noted the duty to defend arises “even if only one of several theories is within the potential coverage of the policy.”
It remains to be seen whether the 11th Circuit will follow this ruling in the Anda appeal or go in another direction.
We have seen a recent rash of cases where defending insurers are stretching to new lengths to force their insureds to contribute substantially more that the deductible bargained for in the policy, often grasping at the straw that the negligent acts alleged against the insured were actually intentional—perhaps even uninsurable. We used to call this “post-claim underwriting” because, in effect, the insurers are re-writing the policies to include large self-insured retentions.
We have also seen insurers argue that since the insured was urging settlement (in a matter where the damages were substantial and liability reasonably clear), they must contribute a portion to the settlement. Why? Because the insured wanted “peace of mind” and (contrary to decades of advertising), “peace of mind” was not covered! We have also seen insurers argue an insured must contribute sums above the deductible in order to settle a case, because the loss claimed against the insured were not really damages.
This unique insurance sleight of hand occurred in a case where an insured lawyer had represented a client who was a defendant in a lawsuit. In the course of the underlying matter, the Court awarded costs against the client. The client paid the award and more expense to settle the case. The client then brought malpractice claims against the lawyer. The allegations were the standard claims of professional negligence and resulting damages. Insurer defended but then balked at settling—claiming the Court award against the client amounted to uninsurable sanctions, ignoring the actual claims the client made. Instead, the insurer demanded the insured pay some portion of any settlement above its deductible.
It is perhaps not a surprise that no California court has addressed this insurance company excuse not to pay a claim. However, a Pennsylvania federal court decision directly addressed this rather aggressive coverage defense, which could be helpful to practitioners faced with similar tactics from insurers. In Post v. St. Paul Travelers Ins. Co., 593 F. Supp. 2d 766 (E.D. Pa. 2009), an insured lawyer filed a coverage suit against his malpractice insurer who refused coverage. The insured lawyers represented a client, Mercy Hospital in an underlying medical malpractice case. During trial of that case the parties reached a settlement. Mercy claimed they had to settle because of alleged discovery abuses by their defense counsel, and was contemplating a lawsuit against their lawyers. The lawyers put Travelers on notice of the potential claim.
The underlying plaintiffs then brought a sanctions motion against the lawyers, which Mercy joined! Mercy’s lawyer then asked Travelers to defend the motion for sanctions as it would be defense of the stated malpractice claim. Travelers refused, and the lawyers then sued Travelers for breach of contract and bad faith. In deciding the cross-motions in the coverage case, the Court examined whether Travelers had a duty to defend the sanctions motion and the malpractice claims because both might result in malpractice damages.
First the Court easily found the duty to defend the malpractice claim and the petition for sanctions once Mercy joined it. Second, on the duty to indemnify, the Court easily discarded Travelers argument that because Mercy’s malpractice claims were based in part on discovery sanctions against the lawyers, their claims could not be for damages. Rather the Court found: “The term “sanctions” was undefined in the Liability Policy. If an attorney errs, his or her client typically seeks malpractice damages, not sanctions or penalties. Sanctions, in particular, are understood by the legal community to be sought by opposing counsel. The Court found the “sanctions exclusion” as in the Travelers policy is “commonly understood” to “refer to sanctions motions brought by opposing counsel.” Thus the Court found that the actual sanctions Mercy sought in the sanctions petition were really malpractice damages “even though brought under a cause of action for sanctions”!
What next will we see? Insurers are employing imaginative coverage counsel so no argument is too outlandish. Stay tuned
Normally, the statute of limitations sets in when “the cause of action shall have accrued,” to quote California Code of Civil Procedure section 312. In an effort to simplify that date for lay readers, the Sacramento County Public Law Library has stated in a public guide that “generally, a cause of action accrues on the date of injury or the date the incident occurs. If a cause of action has multiple elements, the statute of limitations accrues when the final element occurs.”
Insurers have a duty to settle third party claims when it appears that liability is fairly certain and that a verdict in excess of available policy limits is possible, or perhaps when such an excess judgment is probable. Brown v. Guarantee Insurance Company (1957) 155 Cal. App. 2d 679, 686. But if the insurer fails to do so and an excess verdict results, causing the insured to be liable for the excess above policy limits which a settlement would have avoided and possibly other damages as well, such as emotional distress or loss of valued property in order to pay the excess amount, when does the statute of limitations begin to run?
A much-valued treatise, California Insurance Litigation, by Croskey et al., dances around the subject, saying at times that this occurs when the plaintiff “is entitled to a legal remedy” (sec. 12:443, for which it cites a non-insurance case, Davies v. Krasna (1975) 14 Cal. 3d 502, 514). This would seem to happen as soon as the wrongful failure to settle takes place – potentially a long time before the underlying case is then tried and results in the excess verdict which the insured would have to bear on his or her own account. Elsewhere, the treatise says that the statute of limitations only begins to run when a final judgment in excess of policy limits is entered, citing Brown v. Guarantee Ins. Co., supra (sec. 12:1151). The question when the cause of action for bad faith failure to settle matures has not received much attention in California in recent years, but it is an important question: if the claim is triggered when the refusal to settle occurs, the suit may have to be idled until the plaintiff’s damages are complete, and the complaint may have to be amended to allege the adverse outcome of the underlying action if such a judgment is entered and then becomes final. Or if the suit is not filed until the excess judgment is final and until such things as the insured’s emotional distress and possible loss of property through enforcement of the excess judgment have occurred, the insurer may claim that the time to file such suit, calculated from the wrongful refusal, has meanwhile expired.
These issues were carefully and extensively considered recently by the Supreme Court of Delaware, which discussed cases from throughout the country ruling either way on the issue and then decided unanimously that “a claim that an insurer acted in bad faith when it refused to settle a third-party insurance claim accrues when an excess judgment against an insured becomes final and non-appealable.” Connelly v. State Farm Mutual Automobile Insurance Company (2016) ___ A. 3d ___: 2016 WL 836983.
The Connelly case cites some decades-old California cases on the same side of the issue. It is well reasoned and carefully researched, reviewing cases nationwide which take various approaches to the subject. And it reaches the correct result: it is consistent with well-established California law, which has long held that in evaluating settlement, the insurer owes its insured the duty to evaluate the offer “as though it alone were liable for the entire amount of the judgment” and that “the only permissible consideration in evaluating the reasonableness of the settlement offer becomes whether, in light of the victim’s injuries and the probable liability of the insured, the ultimate judgment is likely to exceed the amount of the settlement offer. Such factors as the limits imposed by the policy, a desire to reduce the amount of future settlements, or a belief that the policy does not provide coverage, should not affect a decision as to whether the settlement offer in question is a reasonable one. “ Johansen v. California State Auto. Assn. Inter-Ins. Bureau (1975) 15 Cal. 3d 9.
Connelly does a good job of collecting and endorsing these sound principles, and should serve as a guide for the California courts when this situations arises.
For policyholders and attorneys that have feared the lack of coverage for data breaches under traditional policies (CGL, property), a recent ruling suggest that it is not time to write off those policies as a potential source of coverage. Yesterday, the Fourth Circuit issued an opinion upholding a trial court ruling that Travelers had a duty to defend its insured, a medical records company, for a class action resulting from a massive data breach. While this Fourth Circuit ruling was unpublished, it should give policyholders hope because the Court used logic and well-founded law on the broad duty to defend in reaching a completely different ruling than the one reached by the New York trial court in Sony v. Zurich, and which settled on appeal.
The class action resulted from the public disclosure of electronic medical records that were kept on a server operated by Portal Healthcare. Two of the medical patient plaintiffs discovered that their medical records were publicly available on the Internet without any password protection when they Googled themselves – a harrowing discovery, to be sure. Plaintiffs alleged that Portal negligently failed to secure it server, which contained confidential records such that those records were freely available on the internet without a password.
Travelers filed a separate coverage action, contending that it did not owe Portal a duty to defend. Portal, in contrast, argued that there had been a potential publication of the records, entitling it to a defense. The trial court ruled with Portal on summary judgment, and the Fourth Circuit affirmed that ruling, holding that “the class-action complaint ‘at least potentially or arguably’ alleges a ‘publication’ of private medical information by Portal”, which would constitute conduct potentially covered under the CGL’s personal and advertising injury coverage provision.
It is about time for a ruling in favor of policyholders for information-related breaches. But there are also some questions about how broadly this opinion can be read. In addition to being unpublished, how far will other courts go in finding coverage under a CGL personal and advertising injury provision? Will courts find that the publishing of such information to somewhere other than the internet triggers a duty to defend? What if it is a hacker that publishes the information and not the server company? That would lead to the somewhat ridiculous scenario where a company storing such records is covered when it makes a mistake, but not if a nefarious actor is involved and hacks that same information.
Needless to say, this is a positive result for policyholders. And while the facts of the case may limit the scope of its impact, any pro coverage ruling related to the internet is good news. But this is yet another reminder that now is a good time to review your coverage portfolio – CGL, property insurance, cyber insurance – and understand the strengths and weaknesses of your coverage.
Insurance companies often seek subrogation after they paid a claim, even at times squeezing their insureds for first place in line to recover their respective damages from a tortfeasor.
The law has imposed certain restrictions on insurers’ rights in this area, basically limiting insurers’ subrogation rights to cases where the third party’s “equitable position is inferior to that of the insurer” (Meyers v. Bank of America Ass’n (1938) 11 Cal. 2d 92); but a recent decision can be read to challenge the rule of equity in such cases because Civil Code section 954, unchanged since 1872, provides that “a thing in action, arising out of a right of property, or out of an obligation, may be transferred by the owner,” creating a legal right to assert an assigned claim.
The facts of that new case, Amco Insurance Company v. All Solutions Insurance Agency LLC, 16 DJDAR 1383, were complex: one landowner negligently caused a fire which spread to two adjoining properties and caused damages there. The landowner’s own insurance had lapsed days earlier and he claimed that his broker was responsible for that lapse. He assigned his right to sue the broker to the other victims of the fire and, in one case, to the victim’s insurer.
These facts created an opportunity for the court to examine this rarely visited subject with great scholarship. It found that the law of insurance subrogation had essentially ignored section 954, a point which leaves us with questions whether, if this legal right of assignment controls over the rule of equity in insurance subrogation, policyholders and third party victims of negligence may be made to cade their positions, in whole or in part, to insurers claiming subrogation rights.
Not long ago an owner of a four-unit apartment building, fully insured with a Landlord/Tenants package policy and Umbrella coverage, tendered an injury lawsuit to his insurance company. The insured had hired a roofer to replace the roof. The roofer hired a worker to help and the worker fell from the roof just hours into the job, and was badly injured. The worker filed suit and the insurer defended but initially refused to settle—until the owner engaged coverage counsel.
The insurer had appointed defense counsel, who recommended a settlement which would include funds from the Umbrella, as the injuries were serious and permanent. The insurance company balked at settling and attempted to hide behind the “employee exclusion.” The insured owner never even met the worker much less hired him—how could the “employee exclusion” impair coverage in the Umbrella?
As coverage counsel we went to work quickly and learned that the facts included that the roofer was unlicensed—hence the insurer’s coverage counsel argued the Umbrella was “not in play.” We found that under the Labor Code 2750.5, as a general proposition, the owner who hired the unlicensed roofer became the roofer’s “statutory employer,” and thus was likely liable for the injuries. However, under Labor Code 3352(h) the worker who worked less than 52 hours before his injury was not an “employee” for workers compensation purposes. We successfully convinced the insurer that, this injured worker did not meet the Labor Code 3352(h) definition as he worked only a few hours before his fall, and, as such, the worker could not possibly be an “employee” as that term was used in the Umbrella and primary “employee exclusion.” We secured a settlement for our client in record time!
The take away lesson for such insured owners is please use licensed contractors! Also, when insurers balk at paying settlements, coverage counsel can loosen the purse strings.
The term Social Engineering keeps cropping up recently in the new world of cybersecurity—to what does this term refer? To a scam as old as the hills. You know the con: an innocuous person asks you to accept a cashier’s check to deposit in your account, and in return just asks you to give them cash—not even the whole face amount—you can keep some for your troubles. Or, a lady dressed as a nun shows you a check she tells you is a donation and asks if she can sign it over to you in return for cash as she does not have time to go to the bank? These cons worked well when we had to stand in line for a teller, but are less prevalent now.
More modern versions include an unsolicited email from an overseas potential new client sent to a gullible lawyer: this client just settled her case and needs a local lawyer with a trust account so that the other party’s settlement money – a cashier’s check – can be deposited and distributed to her. The cashier’s check will come in the mail to the lawyer. More work will follow and this new client is happy to sign a retainer agreement and pay for the services—out of the cashier’s check, of course. The balance is to be wired to the putative client. We have actually seen such scams succeed.
Other sophisticated versions include the fake email messages designed to fool the unwary into clicking into malware, downloading malicious software, and verifying passwords to allow access to private information including, of course, bank accounts. These can be very clever where the hacker impersonates legitimate businesses, people you know, even your company’s own network administrator. Consider this example: **URGENT ** Email from CFO: Please wire funds immediately to our supplier in China because we MUST keep production on line!! Hopefully the salesman will not fall for it.
Other than being hyper-vigilant and careful about any suspicious emails (hint: be sure to pay close attention to the email address of the sender) is there insurance in the event of a loss? This depends on the loss, of course. Installing malware may or may not be covered in a CGL—if actual damage to tangible property occurs—a destroyed hard drive or unusable laptop, for example, coverage may well be possible.
Loss of money, securities or other property, by fraudulent means is often purportedly covered in Crime or fidelity policies. Cyber-crime coverage would appear to cover loss of money by way of computer fraud. However, insurers will resist coverage for these losses in traditional policies, and even Computer Crime policies by arguing that inducing an insured to transfer funds under false pretenses is not theft but rather a voluntary transfer by the insured! Shockingly, some courts have agreed—Great American v AFS/BEX Fin. Servs. Inc., 2008 U.S. Dist. LEXIS 55532 (N.D. Tex.); Pinnacle Processing Group Inc. v Hartford Cas. Ins., 2011 U.S. Dist. LEXIS 128203 (W.D. Wash.); Pestmaster Serv. v. Travelers, 2014 LEXIS 108416 (C.D. Cal.)
Occasionally, courts will enforce coverage for an insured, but only where the insured can show that the thief used instructions that purport to have been authorized, and the insured can otherwise jump through the many hoops required in the policy to obtain the policy benefits. Sb1 Fed. Credit Union v. FinSecure LLC, 2014 U.S. Dist LEXIS 49596 (E.D. Pa.); Morgan Stanley, et al v. Chubb, 2005 NJ Super. Unpub. LEXIS 798 (N.J.); Northside Bank v. American Casualty Co., 2001 WL 34090139 (Pa.)
This highlights the importance of carefully reviewing Crime Coverage, including Computer Crime coverage to determine if the policy language can be negotiated to actually cover fraudulent inducement accomplished over the internet as a computer crime. Terms of the Cyber Insurance policies are often negotiable and a consultation with knowledgeable coverage counsel is recommended so that paying the premiums will not be a futility, and so that when a loss occurs, the policyholder will not suffer a second unexpected loss of insurance coverage.