Print
While there has been significant increase in cybersecurity litigation this summer, one closely watched case, Columbia Cas. Co. v. Cottage Health Sys., 15-cv-3432 (2015 C.D. Cal.), has been taken outside the courtroom. On July 17, 2015, the District Court for the Central District of California granted Cottage Health’s motion to dismiss and left the parties to mediate the coverage dispute. While the case is dismissed (without prejudice), the District Court made it clear that the dispute could end up back in court if mediation is unsuccessful.
On May 7, 2015, Columbia Casualty filed its Complaint seeking a declaration that a “failure to follow minimum required practices” exclusion in a cyber insurance policy barred coverage for $4.125 million in costs related to Cottage Health’s 2013 data breach of patient information. This exclusion required the insured to “continuously implement” its cyber security controls identified in the insurance application submitted prior to the inception of the policy. In its Complaint for Declaratory Judgment, Columbia asserted coverage was barred because the Cottage Health allegedly failed to monitor safeguards identified in the insurance application submitted by Cottage Health.
In its Order granting the motion to dismiss, the District Court stated that after filing the action the parties agreed to mediate the dispute as required under the insurance policy and “the sole question in this motion is to dismiss this case altogether or issue a stay.” Columbia argued the motion to dismiss should have been denied when the court considered the parties “pre-suit history” and that the case should be merely stayed rather than dismissed. On the other hand, Cottage Health argued the case should be dismissed because it would have continued settlement discussions even though initial discussions were unsuccessful.
In support of its decision, the District Court relied on the policy language requiring “all disputes and differences between the Insured and the Insurer which may arise under or in connection with this policy…shall be submitted to the alternative dispute resolution (“ADR”) process” and that if mediation is the chosen method of ADR “no…judicial proceeding shall be commenced until the mediation shall have been terminated and at least 60 days shall have elapsed from the date of the termination.” The District Court held this policy language was enforceable and “controls the timing of suits arising out of the policy and requires that the ADR process take place before a lawsuit is initiated.” Therefore, the District Court dismissed the coverage dispute when the complaint did not allege that Columbia fulfilled this requirement.
This case generated a significant amount of attention when the complaint was filed and all developments were closely watched by insurers, policyholders and the healthcare industry. While it would have been interesting to see a decision on the merits of the case, the Cottage Health decision still demonstrates an important point: cyber insurance is fundamentally no different than traditional lines of insurance. Consequently, while the underlying claims may be new, the basic insurance concepts still control.