Cottage Health vs Columbia Casualty Company et al
Case No: 16CV02310
Hearing Date: Fri Jun 01, 2018 9:30

Nature of Proceedings: Motion: Summary Judgment

TENTATIVE RULING: Defendant Underwriters’ motion for summary adjudication of plaintiff’s breach of contract cause of action is denied.

BACKGROUND:

This is an insurance coverage dispute. On January 28, 2014, a class action complaint was filed by Kenneth Rice in Orange County Superior Court against Cottage Health (“Cottage”), Rice, et al. v. Insync, et al., Case No. 30-2014-00701147-CU-CJP, alleging that Cottage negligently disclosed on the internet various patient records for the period September 29, 2009 through December 2, 2013. The patient records contained names, addresses, telephone numbers, dates of birth, medical information, financial information, and other confidential information. The records of approximately 32,000 patients were allegedly disclosed. The Rice action alleged that Cottage violated the California Confidentiality of Medical Information Act (“CMIA”) and the federal Health Insurance Portability Accountability Act (“HIPAA”). As a result of the data breach, the United States Department of Health and Human Services, Office of Civil Rights, and the California Attorney General’s Office also commenced regulatory proceedings against Cottage. Like the Rice lawsuit, the regulatory proceedings alleged that Cottage breached its obligations under HIPAA and CMIA.

At the time of the data breach, Cottage was insured against liability under a privacy injury “NetProtect 360” policy issued by defendant Columbia Casualty Company (“Columbia”), Policy No. 42556514002, with coverage limits of $10,000,000 per claim and a $100,000 deductible. Cottage was also insured against liability under an “Information Security & Privacy” policy issued by defendant Certain Underwriters at Lloyd’s London (“Underwriters”), Policy No. P133938, with coverage limits of $2,000,000. The Underwriters policy contains an “Other Insurance” clause which expressly provides that its coverage is “excess” over and above any other valid and collectible insurance available to Cottage, including any self-insured retention or deductible amount.

In November 2014, Cottage settled the Rice action for $4,125,000. The settlement was funded by Columbia, though it reserved the right to deny coverage later and to recover the amounts paid. Columbia has since denied all coverage for the Rice lawsuit and currently seeks reimbursement of the settlement and related defense costs, totaling $5,179,483. Underwriters was not involved in the Rice litigation or settlement. In November 2017, Cottage paid $500,000 to resolve the regulatory claim brought by the California Attorney General’s Office, none of which was reimbursed by any insurer. Columbia previously denied coverage for the California Attorney General claim. When Underwriters was notified of the settlement with the California Attorney General’s Office, it declined to participate in the settlement and stated that it was reserving all rights under its policy, including all coverage defenses.

On May 31, 2016, Cottage filed the present action against Columbia and Underwriters, seeking coverage for the Rice action and the regulatory proceedings. The complaint alleges causes of action for (1) breach of contract, (2) tortious breach of the implied covenant of good faith and fair dealing, and (3) declaratory relief. The first and third causes of action are asserted against both Columbia and Underwriters, while the second cause of action is asserted against Columbia only. Cottage seeks a declaration that it has no obligation to reimburse Columbia for the amounts it spent resolving the Rice lawsuit. Cottage also seeks a declaration of coverage under the Underwriters policy. The breach of contract claim seeks damages against both Columbia and Underwriters for refusing to defend or pay in full the settlement costs in the Rice action and the state and federal regulatory proceedings.

Underwriters now moves for summary adjudication and requests dismissal of Cottage’s breach of contract cause of action on the ground that coverage under its excess policy was never triggered, and hence, there can be no breach of contract, because Cottage has not established, and cannot establish, that the policy limits of Columbia’s primary policy have been exhausted. There has also been no determination that the Columbia policy does not afford coverage for the underlying claims.

ANALYSIS:

A defendant may move for summary adjudication as to one or more claims within an action if it is contended that the claim has no merit. Code Civ. Proc. §437c, subd. (f)(1). A defendant meets its burden of showing that a cause of action has no merit if it has shown that one or more elements of the cause of action cannot be established or that there is a complete defense to the action. Code Civ. Proc. §437c, subd. (p)(2). If the defendant meets its initial burden of proof, the burden shifts to the plaintiff to make a prima facie showing that a triable issue of material fact exists. Aguilar v. Atlantic Richfield Company (2001) 25 Cal.4th 826, 850. If the defendant fails to meet its initial burden or the plaintiff proves the existence of a triable issue of fact, the motion for summary adjudication must be denied. Consumer Cause, Inc. v. SmileCare (2001) 91 Cal.App.4th 454, 468.

Underwriters seeks summary adjudication of Cottage’s breach of contract cause of action. To prevail on a breach of contract claim, a plaintiff must allege and prove (1) the existence of a contract, (2) the plaintiff’s performance or excuse for non-performance, (3) the defendant’s breach, and (4) resulting damages to the plaintiff. Acoustics, Inc. v. Trepte Construction Company (1971) 14 Cal.App.3d 887, 913. Thus, in an action on an insurance policy, if the insured cannot establish that the insurer breached any duty under the policy or that the insured suffered any damages as a result of the breach, the insurer is entitled to judgment in its favor. Tradewinds Escrow, Inv. v. Truck Insurance Exchange (2002) 97 Cal.App.4th 704, 712 (summary judgment properly granted in favor of liability insurer on breach of contract cause of action where insured could not establish a breach of the underlying policy or damages); Emerald Bay Community Association v. Golden Eagle Insurance Corporation (2005) 130 Cal.App.4th 1078, 1092 (judgment in favor of insurer on breach of contract claim affirmed where plaintiff failed to establish any compensable damages).

Underwriters contends that it has no obligation to provide coverage to Cottage for the class action lawsuit or the regulatory investigations arising out of the 2013 data breach because the limits of the primary policy issued by Columbia have never been exhausted. Unless and until the Columbia policy limits are exhausted, or there is a determination of no coverage under the Columbia policy, which has also not occurred, Underwriters cannot be held liable for breach of contract because it has no duty to contribute any amounts towards the underlying defense costs and/or settlements. The “Other Insurance” provision in the Underwriters “Information Security & Privacy” policy issued to Cottage, Policy No. P133938, provides:

“The insurance under the Policy shall apply in excess of any other valid and collectible insurance available to any Insured, including any self-insured retention or deductible portion thereof unless such other insurance is written only as specific excess insurance over the Policy Aggregate Limit or any other applicable Limit of Liability of this Policy.”

(Antonucci Dec., ¶2, Ex. 2, Underwriters Policy No. P133938, p. 39.)

The insuring agreement in the Columbia “NetProtect 360” policy provides:

“If the Insuring Agreement has been purchased, as indicated in the Declarations, the Insurer will pay on behalf of the Insured all sums in excess of the Deductible and up to the applicable limit of insurance that the Insured shall become legally obligated to pay:

“A. Privacy Injury Claim

“as Damages resulting from any Privacy Injury Claim both first made against the Insured and reported to the Insurer in writing during the Policy Period, or any Extended Reporting Period, if applicable, alleging any Wrongful Act by the Insured, or by someone for whose Wrongful Act the Insured is legally responsible;

“B. Privacy Regulation Proceeding

“as Damages and Claim Expenses resulting from any Privacy Regulation Proceeding both first made against the Insured and reported to the Insurer in writing during the Policy Period, or any Extended Reporting Period, if applicable, alleging any Wrongful Act by the Insured or by someone for whose Wrongful Act the Insured is legally responsible.”

(Hazlehurst Dec., ¶3, Ex. 1, Complaint, Ex. A, Columbia Policy No. 42556514002, p. 21.)

The Columbia policy defines “Privacy Injury” to mean:

“A. any act or omission with respect to Nonpublic Personal Information:

“1. in violation of an individual’s right of privacy, including violation of: any federal, state, foreign or other law, statute or regulation governing confidentiality, integrity or accessibility of Nonpublic Personal Information such as the Health Insurance Portability and Accountability Act [“HIPAA”] of 1996 . . . .”

(Hazlehurst Dec., ¶3, Ex. 1, Complaint, Ex. A, Columbia Policy No. 42556514002, p. 43.)

The Columbia policy includes a Specific Primary Endorsement which expressly states that the Columbia policy is primary and the Underwriters policy is excess. The endorsement reads:

“In consideration of the premium paid for this Policy, it is hereby understood and agreed that Section VIII. Conditions. Paragraph F. Loss Participation is amended to add the following at the end:

“Provided, however, that this insurance will be primary to the following specific policies:

“TERM: October 1, 2013 to October 1, 2014

“CARRIER: [Underwriters] Syndicate (Lloyd’s)

“POLICY: [Underwriters] Policy #P133938”

(Hazlehurst Dec., ¶3, Ex. 1, Complaint, Ex. A, Columbia Policy No. 42556514002, p. 73.)

The Columbia policy has a $10 million limit of liability. (Hazlehurst Dec., ¶3, Ex. 1, Complaint, Ex. A, Columbia Policy No. 42556514002, p. 18.) Columbia paid $5,179,483 in settlement and defense costs in the Rice action, leaving a remaining coverage limit of $4,820,517. (Hazlehurst Dec., ¶5, Ex. 4, Columbia’s Responses to Underwriters’ First set of Special Interrogatories, Nos. 1, 2.) Because the Columbia policy limits have not been exhausted, Underwriters argues that no amounts are owed under its policy. “[A]n excess insurer has no duty to participate in the insured’s defense or contribute to a settlement on its behalf until primary coverages are exhausted.” Phoenix Insurance Company v. United States Fire Insurance Company (1987) 189 Cal.App.3d 1511, 1528. Further, there has been no determination that coverage is unavailable under the Columbia policy for any amounts Cottage claims it incurred or is owed in connection with the Rice action or the regulatory investigations and therefore Cottage has not sustained any damages under the Underwriters policy, entitling Underwriters to judgment on Cottage’s breach of contract claim.

Underwriters additionally argues that it is entitled to judgment on plaintiff’s contract claim because the Underwriters policy requires its consent to any settlement or defense costs as a condition precedent to coverage and its consent was not obtained before Cottage agreed to the underlying settlements and litigation costs. Section X.B.3 of the Underwriters policy provides:

“The insured shall not admit liability, make any payment, assume any obligations, incur any expense, enter into any settlement, stipulate to any judgment or award or dispose of any Claim without the written consent of Underwriters.”

(Antonucci Dec., ¶2, Ex. 2, Underwriters Policy No. P133938, p. 38.)

A provision in an insurance policy requiring the insurer’s consent to settlement is enforceable and precludes coverage where the insurer’s consent was not obtained before settlement. Insua v. Scottsdale Insurance Company (2002) 104 Cal.App.4th 737, 745 (holding that the no-voluntary-payments provision in policy precluded the insured from recovering his pre-tender expenses); Jamestown Builders, Inc. v. General Star Indemnity Company (1999) 77 Cal.App.4th 341, 345-346 (holding that no-voluntary-payments provision applied to preclude coverage for repair expenses voluntarily incurred by insured). Here, Cottage entered into settlements and incurred defense costs in the Rice litigation and the regulatory investigations without Underwriters’ written consent. Accordingly, Cottage cannot show that any amounts it incurred or claims to be owed are covered by the Underwriters policy.

This is Underwriters’ second motion for summary adjudication requesting dismissal of Cottage’s breach of contract cause of action. In the earlier motion, filed on July 27, 2017, Underwriters argued, as it does here, that the breach of contract claim is premature because “the primary policy limits under the Columbia policy have not been exhausted, and any potential coverage under the Underwriters policy has not attached.” (Jackson Dec., ¶10, Ex. G, Underwriters’ First Motion for Summary Adjudication, p. 2:1-2.) Underwriters further argued, again as it does here, that its policy is not obligated to “drop down” and provide a defense to the underlying actions “unless there is a determination that coverage is not available under the Columbia policy.” (Jackson Dec., ¶10, Ex. G, Underwriters’ First Motion for Summary Adjudication, p. 2:4-5.) On October 13, 2017, the court denied Underwriters’ motion, finding that Underwriters had failed to show “that there is coverage under the Columbia Policy to the full extent of its stated limit and that coverage under the Columbia Policy is not subject to limitation.” (Jackson Dec., ¶11, Ex. H, Order Denying Underwriters’ First Motion for Summary Adjudication, p. 5.) In other words, Underwriters had failed to make any showing that there is full and complete coverage under the Columbia policy so as to absolve Underwriters of any obligation to pay Cottage for its losses.

Underwriters’ current motion will be denied for this same reason. While it is undisputed that the Columbia policy is primary, if the underlying loss exceeds the amount payable under the Columbia policy or the Columbia policy does not afford complete coverage for the underlying claims, then the Underwriters policy may apply. As noted above, the “Other Insurance” provision in the Underwriters policy provides that the Underwriters policy shall apply as excess, but only where there is other “valid and collectible insurance” available to the insured. (Antonucci Dec., ¶2, Ex. 2, Underwriters Policy No. P133938, p. 39.) In this case, Columbia paid $5,179,483 in settlement and defense costs in the Rice action (Hazlehurst Dec., ¶5, Ex. 4, Columbia’s Responses to Underwriters’ First set of Special Interrogatories, Nos. 1), but it now seeks reimbursement of these expenses through its cross-complaint against Cottage. Moreover, Columbia has declined to reimburse Cottage for the $500,000 it paid towards the settlement with the California Attorney General’s Office in November 2017, meaning that coverage under the Underwriters policy may yet be triggered.

In the absence of underlying coverage, the Underwriters policy provides primary insurance. The insuring agreement reads, in relevant part:

“A. Information Security & Privacy Liability

“To pay on behalf of the Insured:

“Damages and Claims Expenses, in excess of the Retention, which the Insured shall become legally obligated to pay because of any Claim, including a Claim for violation of a Privacy Law, first made against any Insured and reported to Underwriters during the Policy Period or Optional Extension Period (if applicable) for:

“1. theft, loss, or Unauthorized Disclosure of Personally Identifiable Non-Public Information or Third Party Corporate Information that is in the care, custody or control of the Insured Organization, or an independent contractor that is holding, processing or transferring such information on behalf of the Insured Organization, provided such theft, loss or Unauthorized Disclosure takes place on or after the Retroactive Date set forth in Item 7.A. of the Declarations and before the end of the Policy Period.”

(Antonucci Dec., ¶2, Ex. 2, Underwriters Policy No. P133938, p. 22.)

It remains to be determined, therefore, whether coverage is available under either the Columbia policy or the Underwriters policy, precluding summary adjudication of Cottage’s breach of contract cause of action.

Underwriters’ lack of consent argument also lacks merit. Underwriters contends that there can be no coverage under its policy because it did not consent to the settlements in the Rice action or the Attorney General regulatory matter. This is a disputed issue of fact, however. Contemporaneous correspondence at the time of each settlement shows that Underwriters was made aware of the settlements and did not clearly object to either before they were finalized. On December 22, 2014, Underwriters acknowledged the pending settlement in the Rice lawsuit, but stated that it would not participate in the settlement given the existence of the Columbia policy. (Jackson Dec., ¶3, Ex. B, December 22, 2014 Correspondence, p. 1.) On November 17, 2017, Cottage advised Underwriters that it was engaging in settlement discussions with the California Attorney General. The following day Underwriters responded that it was “reserving all rights under the Underwriters Policy with respect to any potential settlement.” (Hazlehurst Dec., ¶13.) Accordingly, it is unclear from Underwriters’ “hands-off” approach to the settlements whether it was voicing approval or disapproval.

Based on the foregoing, the court will deny Underwriters’ motion for summary adjudication of Cottage’s breach of contract claim.