Opinion
2:21-cv-0616-BJR
11-16-2022
ATLANTIC SPECIALTY INSURANCE COMPANY, Plaintiff, v. LEXINGTON INSURANCE COMPANY and BCS INSURANCE COMPANY, Defendants.
ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT
BARBARA JACOBS ROTHSTEIN U.S. DISTRICT COURT JUDGE
I. INTRODUCTION
This matter comes before the Court on cross Motions for Summary Judgment brought by, respectively: (1) Defendant BCS Insurance Company (“BCS”); and (2) Plaintiff Atlantic Specialty Insurance Company (“ASIC”). See Dkt. Nos. 118, 120. BCS seeks dismissal of the ASIC Complaint in its entirety. ASIC seeks a declaration in its favor that: (1) BCS has a duty to indemnify the parties' mutual insured, nonparty Premera Blue Cross (Count I); ASIC has no duty to indemnify Premera pursuant to its insuring agreements (Count II); and ASIC has no duty to indemnify Premera pursuant to several exclusionary clauses in the policies (Counts III-V). ASIC seeks judgment for contractual and equitable subrogation against BCS. (Count VI). Having reviewed the parties' briefs filed in support of and opposition to both motions, and the exhibits filed in connection therewith, the Court finds and rules as follows.
II. BACKGROUND
This insurance coverage dispute arose out of claims against the parties' mutual insured, nonparty Premera Blue Cross. In early 2014, computer hackers were able to access Premera's computer network, resulting in a massive data breach that compromised the private financial and health information of over 10 million Premera customers and employees. The breach led to the filing of a number of lawsuits against Premera, including a multidistrict litigation action (the “MDL lawsuit”) and lawsuits brought by 30 state attorneys general (the “AG lawsuits”). In sum, the lawsuits claimed that Premera had breached a duty to protect consumers' confidential data, resulting in damages totaling millions of dollars.
Premera turned to its insurance carriers for coverage. Premera's coverage included two layers of cyber security insurance; a primary comprehensive general liability (CGL) policy and general liability umbrella policy, both issued by ASIC; and several layers of managed care errors and omissions (“E&O”) insurance, including a secondary excess E&O policy issued by BCS. In late 2015, ASIC filed a lawsuit in this Western District, seeking a declaration that it was not liable for Premera's defense costs or its ultimate liability, related to either the MDL or the AG lawsuits. See Atl. Specialty Ins. Co. v. Premera Blue Cross, No. C15-1927TSZ (“ASIC v. Premera”). The Hon. Thomas Zilly, ruling on a motion for summary judgment, held that ASIC had a duty to defend Premera in the MDL action, concluding that at least one of the MDL claims against Premera (for negligence) was “conceivably covered” under the two ASIC policies. ASIC v. Premera, 2017 WL 11600056, *6 (W.D. Wash. July 12, 2017) (“2017 Order”). The Court did not determine at that time whether ASIC had an obligation to defend Premera in the AG action, or a duty to indemnify Premera for the AG or MDL actions, and stayed the coverage case pending resolution of the underlying lawsuits. Premera ultimately settled the MDL lawsuit for $32 million, and the 30 AG lawsuits for a total of $10 million. See 30 AG Compls. and Consent Js. at Ex. B to Decl. of Robert J. Guite, Dkt. No. 120-9; MDL Compl. and Settlement Agmt. at Exs. A & B to Compl., Dkt. No. 1-1.
ASIC subsequently agreed to pay Premera a total of $14.7 million under the CGL and umbrella policies: approximately $12 million towards the MDL settlement and $2.7 million towards the AG settlements. See Compl., ¶¶ 6, 8; Decl. of Cara Tharp, Dkt. No. 120, and Exs. A, B &D thereto. ASIC made those payments subject to a reservation of the right to seek subrogation against Premera's other insurers. Compl. ¶¶ 6, 8. It later filed the instant lawsuit against two of Premera's E&O insurers: former Defendant Lexington Insurance Company (excess to a primary E&O policy issued by nonparty Ironshore Insurance Company), and BCS (secondary to the Lexington policy). Both the BCS and Lexington policies follow form to the Ironshore policy and are operatively identical for purposes of this lawsuit.
Premera's primary and excess cyber security insurance carriers paid the limits of their policies, totaling $20 million; its E&O primary carrier paid its limit of $10 million, and former Defendant Lexington agreed to pay $9,605,350, short of its $10 million limit.
Ruling on cross motions for judgment on the pleadings, this Court ruled that the ASIC policies did not provide coverage for the AG settlement, as those policies contained an exclusion for “fines and penalties,” and the AG settlement payments fit within the commonsense definition of “fines and penalties.” See Order Re: (1) ASIC's Mot. for Part. J. and (2) BCSI's Mot. for J. on the Pldgs., Dkt. No. 98 (“Jan. 7, 2022 Order”). ASIC subsequently settled with Lexington for $394,650, and as a result, Lexington has now paid the $10 million limit of its policy, triggering BCS's obligation for any remaining liability under its secondary excess E&O policy. See Guite Decl., Ex. E.
ASIC seeks subrogation against BCS for the full $10 million limit of the BCS policy, claiming it is entitled, as Premera's subrogee, to indemnity for both the MDL and the AG lawsuits.
III. DISCUSSION
A. Standard for Summary Judgment, Subrogation, and Duty to Indemnify Liability for Settled Claims
Summary judgment is appropriate where “the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed.R.Civ.P. 56(a); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247 (1986). On a motion for summary judgment, the court views the evidence and draws inferences in the light most favorable to the non-moving party. Anderson, 477 U.S. at 255.
Interpretation of an insurance contract is a question of law. Overton v. Consol. Ins. Co., 145 Wn.2d 417, 424 (2002). When interpreting an insurance policy, courts consider the policy “as a whole,” and “give it a fair, reasonable, and sensible construction as would be given to the contract by the average person purchasing insurance.” Quadrant Corp. v. Am. States Ins. Co., 154 Wn.2d 165, 171 (2005) (citation omitted).
“Subrogation” is “[t]he principle under which an insurer that has paid a loss under an insurance policy is entitled to all the rights and remedies belonging to the insured against a third party with respect to any loss covered by the policy.” Mut. of Enumclaw Ins. Co. v. USF Ins. Co., 164 Wn. 2d 411, 423 (2008) (quoting Black's Law Dict. 1467 (8th ed. 2004)). “Subrogation is an equitable doctrine the essential purpose of which is to provide for a proper allocation of payment responsibility. It seeks to impose ultimate responsibility for a wrong or loss on the party who, in equity and good conscience, ought to bear it.” Mahler v. Szucs, 135 Wn. 2d 398, 411 (1998). To demonstrate it is entitled to subrogation, ASIC, standing in the insured's shoes, has the ultimate burden of establishing that the underlying claims resolved pursuant to the MDL and AG settlements fall within the coverage provided by the BCS E&O insurance policy. See In re Feature Realty., 468 F.Supp.2d 1287, 1293-94 (E.D. Wash. 2006).
For cases such as this one concerning an insurer's liability arising out of the insured's settlement of a lawsuit, the standard has been carefully articulated by Washington courts; “in an action to collect insurance proceeds after a settlement, payment is proper as long as the claim is shown to be within the scope of policy coverage.” Pub. Util. Dist. No. 1 of Klickitat Cnty. v. Int'l Ins. Co., 124 Wn. 2d 789, 809 (1994). Importantly, an insured does not need to prove that had it not settled, it would have been found actually liable in the underlying lawsuit. Nordstrom, Inc. v. Chubb & Son, Inc., 820 F.Supp. 530, 535 (W.D. Wash. 1992) (“[T]he insured need not establish actual liability to the party with whom it has settled to recover the amount of settlement from the insurer, so long as potential liability is shown to exist on the facts known to the insured.”). Instead, after a settlement, the question of whether an insurer must pay the insured's liability (i.e. the settlement amount), centers on whether the underlying claims against the insured, for which it was potentially liable, were of a type actually covered under the policy. Id. (court “need only determine that the [insureds] faced a potential liability in the underlying action, and that the settlement reasonably approximated their estimated exposure to liability.”). Such inquiry may be resolved based on claims articulated in the complaint, and the language of the settlement. Sentry Select Ins. Co. v. Alaska Nat'l Ins. Co., No. C01-1956RSM, 2005 WL 8165075, *4 (W.D. Wash. Jan. 13, 2005) (“It is well settled that ‘[w]here an action settles prior to trial ... the duty to indemnify must be determined on the basis of the settlement, i.e., the undisputed facts set forth in the underlying complaint and those known to the parties.'”) (citation omitted).
B. Whether ASIC Is Entitled to Subrogation Against BCS Related to the MDL Settlement
1. Whether the ASIC policies provide coverage for MDL settlement
BCS argues that ASIC is not entitled to subrogation for the $12 million ASIC paid towards Premera's MDL settlement, because that liability is in fact covered under “Coverage B” of ASIC's policies. Coverage B provides that ASIC “will pay those sums that the insured becomes legally obligated to pay as damages because of ‘personal and advertising injury.'” Compl., Ex. E-1, at 268. The policies define “personal and advertising injury” to include an injury “arising out of,” among other events, the “[o]ral or written publication, in any manner, of material that violates a person's right of privacy.” Id., at 276. BCS argues that the MDL claims based on the data breach fit within the definition of “publication,” and that ASIC was therefore liable for the coverage.
ASIC disputes that the MDL settlement was a “personal and advertising injury” within the meaning of the policies. In support of this position, ASIC proposes a limited construction of the term “publication,” which is not defined in the policy. According to ASIC, to be a covered injury under the personal and advertising provision of the CGL and umbrella policies, the material must have been published a) by Premera, the insured, not by a third party (e.g. in this case, the computer hackers); and b) to the general public, not to select parties to whom the data was exposed. ASIC also argues that even if the personal and advertising injury coverage applies to the facts of the Premera data breach, Coverage B contains several exclusions that apply to the facts of the MDL lawsuit. The Court reviews each argument in turn.
a. Plain meaning of “publication” includes the 2014-15 data breach
BCS argues that the term “personal and advertising injury” includes coverage for Premera's settlement of the MDL claims, as the MDL plaintiffs essentially alleged the “publication of material that violates a person's right of privacy.” For example, the MDL's claim for negligence alleged that “Premera's network-security procedures were inadequate” and “the vulnerabilities could be exploited by hackers and expose sensitive information,” resulting in “the illegal sale of the compromised data on the deep web black market.” MDL Compl. ¶ 174-75, Ex. A to Compl. BCS argues these allegations are tantamount to a “publication” within the meaning of the ASIC policies. BCS also points to the MDL plaintiffs' breach of contract claim and their claim for violation of the California Confidential Medical Information Act, which “prohibits entities from negligently disclosing or releasing any person's confidential medical information,” as alleging a “publication of material that violates a person's right of privacy.” See MDL Compl., ¶¶ 178-209; 245-49, 248 (Premera “disclosed and released Plaintiffs' . . . Sensitive Information to hackers.”).
As noted, ASIC argues that the MDL was not premised on facts that could be construed as a “publication,” because information belonging to the Premera customers was neither a) disseminated by Premera, nor b) released to the general public. ASIC argues that any commonsense definition of “publication” would require these elements, citing several dictionary definitions of “publish” and “publication.”
This issue is identical to the one brought before the Hon. Thomas Zilly in ASIC v. Premera, in which the Court was asked to determine whether ASIC had a duty to defend Premera in the MDL lawsuit. The Court in that case concluded that “the negligence claim [in the MDL complaint] asserts that the class action plaintiffs were injured by, and seek damages for, ‘publication, in any manner, of material that violates a person's right of privacy,'” and that therefore ASIC had a duty to defend its insured under the personal and advertising injury provision. ASIC v. Premera, 2017 WL 11600056, at *5.
This Court is bound by the principles of issue preclusion, also known as collateral estoppel, to follow this holding. Issue preclusion applies “when the party seeking estoppel is able to show that ‘(1) the issue decided in the prior adjudication is identical with the one presented in the second action; (2) the prior adjudication [resulted] in a final judgment on the merits; (3) the party against whom [collateral estoppel] is asserted was a party or in privity with a party to the prior adjudication; and (4) there is no injustice if the parties are prevented from relitigating the issues.'” Lopez-Vasquez v. Dep't of Lab. & Indus. of State of Washington, 168 Wn.App. 341, 345 (2012) (quoting Thompson v. State, Dep't of Licensing, 138 Wn.2d 783, 790 (1999)). ASIC argues only that the first element here is not met: that the issues are not “identical” because the 2017 Order concerned ASIC's duty to defend, which as this Court has acknowledged is broader than a duty to indemnify. See Jan. 7, 2022 Order at 10.
However, “[t]he ‘identical issue' requirement [of collateral estoppel] addresses whether ‘identical factual allegations' are at stake in the two proceedings, not whether the ultimate issues or dispositions are the same.” Hardwick v. Cnty. of Orange, 980 F.3d 733, 740 (9th Cir. 2020) (citing Lucido v. Superior Court, 795 P.2d 1223, 1225 (Cal. 1990)); see also Christensen v. Grant Cnty. Hosp. Dist. No. 1, 152 Wn. 2d 299, 319 (2004) (“This case involves issue prelusion, and the same issue is involved, i.e., whether Samaritan discharged Christensen in retaliation for his union activity. It does not matter that the claim or cause of action that Christensen seeks to pursue in [the instant action] is not the same claim or cause of action that was decided [in the previous action].”) (citation omitted); White v. City of Pasadena, 671 F.3d 918, 926 (9th Cir. 2012) (“Issue preclusion, in contrast [to claim preclusion], bars successive litigation of an issue of fact or law actually litigated and resolved in a valid court determination essential to the prior judgment, even if the issue recurs in the context of a different claim.”). In other words, the issue that must be “identical” here for preclusion to apply is whether the MDL plaintiffs alleged a “publication” within the meaning of the ASIC policies, not the ultimate issue of whether ASIC has a duty to defend Premera.
Moreover, it is evident from a close reading of the 2017 Order that its holding was not dependent upon the nature of the claim at issue, or limited by the legal standard governing the duty to defend. The Court in ASIC v. Premera unqualifiedly held that “[t]he negligence claim in the MDL matter alleges the requisite ‘publication.'” 2017 Order, 2017 WL 11600056, at *6. In so holding, the Court squarely rejected both of the arguments ASIC repeats here. The Court dispensed with ASIC's argument that to warrant coverage, a publication must have been made by Premera, observing that “[a]lthough Premera presumably did not intend to expose the class members' confidential information to hackers, it did so by allegedly failing to implement adequate security measures, and the private data has undisputedly been made available to an unknown number of individuals.” Id. Relying on precedent of “other courts . . . in the tort realm,” the Court also held that “communication to a single individual might be sufficient,” and that “with respect to ‘advertising injury,' publication need not even be to a third party.” Id. The 2017 Order unequivocally concluded that “[p]ublication occurs when information is placed before the public; it does not require that anyone actually review the material.” Id.
ASIC's reliance on the distinction between the legal standards of a duty to defend and a duty to indemnify is further undermined because in this case, there is simply no daylight between what the MDL plaintiffs claimed in their complaint, and what matters were resolved by settlement of that lawsuit. See MDL Settlement, Ex. B to Compl., at 3 (expressly resolving “all claims and causes of action asserted, or that could have been asserted against Premera”). ASIC is wrong when it argues (without citation to authority) that “[t]o prove that the ASIC Policies covered the MDL Settlement under the duty to indemnify standard, BCSI must prove that the data stolen from Premera was actually ‘published;' not simply that it was alleged to have been ‘published.'” ASIC Resp. at 9. To the contrary, Washington law is clear that “the insured need not establish actual liability to the party with whom it has settled to recover the amount of settlement from the insurer, so long as potential liability is shown to exist on the facts known to the insured.” Nordstrom Inc., 820 F.Supp. at 535 (“An insurer is not entitled . . . to re-litigate an underlying action following a settlement.”) (citing Luria Bros. & Co. v. Alliance Assurance Co., 780 F.2d 1082, 1091 (2nd Cir.1986)). Accordingly, in this case the standard governing the duty to indemnify the settlement is not materially distinct from that governing the duty to defend. In both cases, the question is whether “‘potential liability' is shown to exist on the facts known to the insured.” Id.
The Court also concludes in the alternative that even if the 2017 Order did not have a technically preclusive effect, the reasoning of that case is sound and the holding is highly persuasive authority. The policies themselves are silent as to both whether a “publication” must have been committed by the insured, and whether it must have been made to the general public. ASIC was certainly capable of limiting the definition of the term “publication” had it intended to do so. See ASIC v. Premera, 2017 WL 11600056, at *6 (“If ASIC wished to limit coverage to claims . . . asserting that the insured itself published private information to the public at large, it should have crafted the Policy accordingly.”) (citing Boeing Co. v. Aetna Cas. & Sur. Co., 113 Wn.2d 869, 887 (1990) (“The [insurance] industry knows how to protect itself and it knows how to write exclusions and conditions.”); Park Univ. Enters., Inc. v. Am. Cas. Co. of Reading, Pa., 314 F.Supp.2d 1094, 1106-09 (D. Kan. 2004) (“American did not define ‘publication' in its policy. If American intended to limit the scope of ‘publication' to those materials sent to a third party, it should have so-stated in the policy.”). As ASIC did not define or limit the term “publication,” it cannot now claim that its proposed limitations should be read into the plain meaning of the term.
The Court concludes that the MDL plaintiffs alleged, and ultimately settled with Premera, a number of claims that fit within the definition of “publication” under the ASIC policies' “personal and advertising injury,” covered under Coverage B.
b. The Exclusion for “Recording and Distribution of Material or Information”
ASIC argues that even if the MDL settlement fits within the definition of a covered loss (as the Court has concluded it does), ASIC is not liable for the MDL settlement because the policies contained applicable exclusions. Under Washington law, “exclusions from coverage of insurance are contrary to the fundamental protective purpose of insurance and will not be extended beyond their clear and unequivocal meaning,” and should be “strictly construed against the insurer.” Stuart v. Am. States Ins. Co., 134 Wn. 2d 814, 818-19 (1998). ASIC, the insurer, bears the burden of demonstrating an exclusion applies. Mut. of Enumclaw Ins. Co., 165 Wn. 2d at 268.
The first claimed exclusion is for coverage for “[t]he Recording and Distribution of Material or Information in Violation of Law” (the “RDI” exclusion). That provision excludes, in relevant part:
“Personal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate:
(1) The Telephone Consumer Protection Act (TCPA) . . .;
(2) The CAN-SPAM Act of 2003 . . .;
(3) The Fair Credit Reporting Act (FCRA) . . .; or
(4) Any federal, state or local statute, ordinance or regulation, other than the TCPA, CAN-SPAM Act of 2003 or FCRA and their amendments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.Compl., Ex. E-1 at 269. ASIC argues that the fourth “catchall” subpart of the exclusion should be read to include HIPAA, thereby excluding claims based on the MDL settlement.
BCS disputes that the RDI exclusion applies to the MDL claims. In support, BCS makes two arguments: first, that the fourth subpart should not be read to include HIPAA; i.e., that the RDI exclusion is not appropriately applied to claims arising out of HIPAA; and second, that even if the RDI exclusion applies to HIPAA-related claims, the provision is not applicable here because the MDL plaintiffs did not assert any claims under HIPAA (nor could they have, as the statute does not provide a private right of action).
ASIC fails to dispute BCS's first argument, either in response to BCS's motion, or in support of its own, and BCS claims ASIC has therefore conceded the point. In any event, the Court finds again that Judge Zilly's holding in ASIC v. Premera precludes relitigation of this issue and is controlling. In that case, the Court was tasked with resolving the exact question posed here-whether the fourth subpart of the RDI exclusion should be construed to include HIPAA- and concluded it could not be. The Court relied on the doctrine of ejusdem generis, the “canon of construction [] requiring that general words, following an enumeration of specific words, [should] be interpreted to embrace only items of a nature similar to the preceding specific words.” ASIC v. Premera, 2017 WL 11600056, at *6. As applied to the RDI exclusion, the ejusdem generis principle dictates that because HIPAA was not “of a nature similar” to the consumer-reporting statutes explicitly referenced elsewhere in the exclusion, Premera “could not have reasonably understood the catch-all provision [of the RDI exclusion] to incorporate alleged HIPAA violations simply by virtue of the preceding reference to the FCRA.” The Court therefore held, again broadly and without reference to, or limitation by, the duty to defend standard, that “to the extent the class action plaintiffs in the underlying litigation assert HIPAA violations, any such claims would not fall within the catch-all language of the violation-of-law exclusion.” Id. at *7. For the reasons articulated above, the doctrine of issue preclusion applies to preclude relitigation of this issue as well.
In addition, and alternatively to applying issue preclusion, the Court finds Judge Zilly's reasoning in ASIC v. Premera sound, and applies it to the same facts at issue here. The Court finds that ASIC has failed to meet the burden, which the law places squarely with the insurer, of demonstrating that its policy exclusion applies. ASIC was quite capable of adding HIPAA-a statute that is practically a household word-to its list of statutes giving rise to a coverage exclusion; it did not. Narrowly construing the exclusion against the insurer, the Court concludes subpart (4) cannot be read to include HIPAA, and coverage of the MDL settlement was not excluded under the RDI exclusion.
c. The Exclusion for “Professional Services”
ASIC did not attempt to invoke the Professional Services exclusion in ASIC v. Premera.
In the opening brief of its Motion for Summary Judgment, ASIC argues the “professional services” exclusion, found in the policies' Financial Institution Endorsement, applies to exclude coverage of the MDL settlement. That exclusion provides “[t]his insurance does not apply to . . . ‘personal and advertising injury' arising out of the rendering or failure to render professional services including but not limited to . . . [a]uditing or maintaining of accounts or records of others” and “[a]cting in any capacity as a fiduciary or trustee.” Compl., Ex. E at 309. ASIC argues the exclusion applies because the MDL plaintiffs alleged Premera failed to protect its customers' private information-in other words, the “accounts and records of others”-giving rise to the security breach underlying the MDL claims.
The term “professional services” is not defined in the policy. BCS argues, however, that the provision does not apply under these circumstances, because “to be considered a professional service, the conduct must arise out of the insured's performance of his specialized vocation or profession.” Bank of California, N.A. v. Opie, 663 F.2d 977, 981 (9th Cir. 1981) (quoted in BCS Mot. at 20, emphasis added by BCS). “Professional services” in the insurance context do not include “general administrative activities that occur in all types of businesses.” PMI Mortg. Ins. Co. v. Am. Int'l Specialty Lines Ins. Co., 394 F.3d 761, 766 (9th Cir. 2005). BCS argues that the “professional services” in which Premera “specializes” is the provision of health insurance, not the maintenance of customer records, and that maintaining the security of customer records is just the kind of ancillary “general administrative activity” that occurs in any business; it is not a “professional service” in which Premera specializes but “failed to render.” Because the injury arose out of Premera's alleged failure to adequately secure its customers' data, not out of the rendering or failure to render health insurance, BCS argues, the Professional Services exclusion does not apply.
ASIC, inexplicably, fails to respond to BCS's arguments, in the context of either party's motion. It therefore does not dispute that Premera's “specialized vocation or profession” is providing health insurance, or that maintaining the security of customers' data is a “general administrative activity” that occurs in any business, including Premera. Indeed, because neither the underlying MDL settlement nor the ASIC settlement with Premera allocated any particular amount of liability between covered and uncovered claims, unless the exclusion applied to all of the claims resolved in the MDL lawsuit, under Washington law ASIC still has a duty to indemnify the entire settlement, as all claims undisputedly arose out of the same factual core. Providence Health & Servs. v. Certain Underwriters at Lloyd's London, 440 F.Supp.3d 1223, 1229 (W.D. Wash. 2020) (“Washington case law precludes allocation of damages to a non-covered claim where, as here, the damages in question were recoverable both under a covered theory and an uncovered theory.”). ASIC has failed to meet its burden of showing that the exclusion would apply to all of the MDL claims.
The MDL plaintiffs did not allege claims arising out of Premera's rendering or failure to render health insurance. Cf. Planet Earth Found. v. Gulf Underwriters Ins. Co., 130 Wn.App. 1040 (2005) (because claims against insured, an advertising and public relations firm, arose from its “alleged rendering or failure to render advertising and public relations, . . . they are covered by the professional services exclusion.”). The Court concludes that the Professional Services exclusion is therefore not applicable to Premera's MDL settlement liability.
2. ASIC cannot pursue claim for equitable contribution
Because the Court concludes that the ASIC primary CGL and umbrella policies provided coverage for Premera's settlement of the MDL lawsuit, the Court need not decide whether the BCS policy would have provided coverage for the MDL settlement. Subrogation is available only when a party pays a debt that is not its own. In re Farmers' & Merchants' State Bank of Nooksack, 175 Wn. 78, 86 (1933) (subrogation available to “those who pay the debt of another.”); Nat'l Fire Ins. Co. of Hartford v. Com. & Indus. Ins. Co., 2017 WL 468575, *2 (W.D. Wash. Feb. 3, 2017). The Court has concluded that the debt did in fact belong to ASIC. ASIC is therefore not entitled to subrogation against BCS, regardless of whether or not the BCS policy could be read to provide coverage.
In response to BCS's motion, and somewhat more obliquely in its own, ASIC makes an argument for equitable contribution, positing that even if the ASIC policies do cover Premera's injury arising from the MDL settlement, ASIC is still entitled to reimbursement, because BCS's policy provides coverage as well. ASIC claims (without citation to authority) that “Washington law holds that the BCSI Policy is primary to the ASIC Umbrella Policy.” ASIC Resp. at 14.
A claim for equitable contribution, however, is “entirely different” from a claim for subrogation. Fireman's Fund Ins. Co. v. Maryland Cas. Co., 65 Cal.App.4th 1279, 1293, 77 Cal.Rptr.2d 296, 303 (1998). As this Court has plainly stated, ASIC did not state a contribution claim in its Complaint, and therefore is not entitled to pursue one:
ASIC also argues in its motion that it is entitled to “contribution” from the two Defendants. ASIC did not assert a contribution claim in its Complaint, and for this reason alone a ruling in its favor on such claim would be improper. Even if ASIC had stated a claim for contribution, as Defendants argue, such claim does not fit the facts of the instant case. In its Reply, ASIC does not dispute Defendants' position that ASIC is not entitled to “contribution,” and appears to have dropped its claim to a right of contribution.
Jan. 7, 2022 Order at 4, n. 2. ASIC has made no attempt to amend the Complaint to add the contribution claim, despite being irrefutably on notice that no such claim had been made.
Moreover, any claim by ASIC for equitable contribution would fail. In Washington, “the insurer who seeks contribution does not sit in the place of the insured and cannot tender a claim to the other insurer. Thus, if the insured has not tendered a claim to an insurer prior to settlement or the end of trial, other insurers cannot recover in equitable contribution against that insurer.” Mut. of Enumclaw Ins. Co. v. USF Ins. Co., 164 Wn. 2d 411, 421 (2008) (emphasis added). It is undisputed that BCS “was not asked by Premera to contribute to any of the settlements.” BCS Mot. at 24. To the extent ASIC is attempting to make a late-stage claim for contribution, that claim fails.
C. Whether ASIC Is Entitled to Subrogation Against BCS Related to the AG Settlement
ASIC contributed $2.7 million towards Premera's $10 million settlement of the state AG lawsuits, reduced to $2,305,350 after Lexington paid ASIC in settlement of this lawsuit. This Court subsequently ruled on a motion for judgment on the pleadings, however, that the AG settlements fell within an exclusionary clause in the ASIC policies that provided “[t]his insurance does not apply to . . . Any obligation to pay fines and penalties.” Ex. E-1 to Compl., at 309 of 458; Ex. E-2 to Compl., at 356 of 458; see Jan. 7, 2022 Order. ASIC therefore now seeks subrogation against BCS for the AG settlements payment, claiming that the BCS E&O policy did provide coverage for the AG settlement.
Given this Court's prior ruling, BCS cannot (and does not) deny that ASIC was not liable under its policies for payment towards the AG settlements. BCS does deny, however, that it, BCS, is liable. BCS argues (1) that “it would be inequitable” for this Court to award ASIC subrogation reimbursement; and (2) that the AG settlements payment is not covered under the BCS policy. The Court addresses each argument in turn.
1. Whether it Would be Inequitable for ASIC to Subrogate Against BCS for AG Settlements Payment
BCS argues it would be inequitable for ASIC to shift any liability for the AG settlements onto BCS, relying on three related arguments. First, BCS argues that it would be inequitable for ASIC, whose liability attached at $5,000 under its primary CGL policy, and $2 million under its umbrella policy, to subrogate against BCS, the secondary excess E&O carrier, whose liability does not attach until $21.5 million, particularly when “ASIC's coverage obligations to Premera for the MDL settlement far exceeded the amount it reimbursed Premera.” BCS Mot. at 24.
ASIC's coverage obligation exceeded its reimbursement, according to BCS, because Premera settled the MDL lawsuit for $32 million, and ASIC contributed only $12 million towards that amount, in part because a number of Premera's other insurance carriers provided coverage. ASIC's contribution to the MDL settlement was well short of the limits of its policies, collectively $17 million. BCS Mot. at 24.
Second, BCS argues that subrogation against it would be inequitable because if Washington's “maximum loss rule” had been applied to apportion coverage in this case, ASIC would have been liable for the full $17 million provided under its CGL and umbrella policies (though in settlement, it has to date paid only approximately $14.3 million), and BCS would not have been liable for anything. Under the maximum loss rule, an insured is reimbursed on a pro rata basis from applicable policies sitting on the same layer of coverage; only after all limits are exhausted on that layer does liability move on to the next layer. See Mission Ins. Co. v. Allendale Mut. Ins. Co., 95 Wn. 2d 464, 466 (1981). Premera's liability from the 2014-15 data breach totaled nearly $49 million; Premera held $57 million in coverage from its primary and first excess policies alone. In other words, Premera could have been made whole without ever going above the first excess layer of coverage, thus never reaching the BCS second excess policy.
ASIC disputes that the maximum loss rule can be applied to this case, given certain “other insurance” provisions in the various policies. The Court does not understand BCS as arguing, however, that the maximum loss rule should be applied in this case; merely that, had Premera's insurers litigated the entire underlying data breach liability, a court would have applied that rule; and that equity therefore now requires apportionment of liability in at least approximate conformity with this rule. The Court therefore does not determine whether the rule would or would not apply.
Third and finally, BCS argues that “[i]t would be inequitable for ASIC, as an umbrella carrier, to shift its coverage burden onto the BCS Second Excess Policy by allocating payments to the State AG settlements when it was liable up to its limit for the MDL settlement.” BCS Mot. at 26. BCS imagines that by allocating to the AG settlements $2.7 million of the total $14.7 million payment ASIC made to Premera-presumably knowing that Premera likely was not entitled to coverage of those AG settlements under the ASIC policies-ASIC increased its chance of obtaining subrogation against an insurer whose policies likely did provide such coverage. According to BCS, rewarding this strategy by allowing subrogation “would encourage insurers to voluntarily pay amounts of a loss it knows is uncovered in an effort to: (1) avoid responsibility for other amounts which are covered and (2) seek recovery for the amounts it paid from other insurers and reduce its liability to zero.” BCS Mot. at 26.
The Court rejects all of these arguments. Taking the third purported inequity first, the Court handily rejects BCS's strained argument that allowing ASIC to “shift” a portion of its total payment to the AG settlements would create an incentive for an insurance carrier “to eliminate its liability by only paying uncovered amounts and securing recovery from other insurers, despite providing coverage for other portions of the loss.” Id. The idea that allowing ASIC to subrogate against BCS for the AG settlements could create an incentive for an insurer to strategically cover an uncovered loss in hopes of later recovery by subrogation, is both farfetched and unsupported by any caselaw.
As to BCS's “maximum loss rule” argument, the Court notes that this rule does not apply to the facts of this case, as the insured settled the entirety of its claim with its insurers, apportioned in ways, and for reasons, that are not in the record (or possibly, anywhere); and that furthermore, BCS's hypothetical scenario in which the maximum loss rule could have applied had Premera not settled, depends on analyzing ASIC's payment towards the MDL and AG settlements as a lump sum, rather than as two separate payments, which they undisputedly were. Claiming an inequity based upon inapplicable law and conjectural facts is simply not persuasive.
All three of BCS's equity arguments amount essentially to the idea that it would be inequitable for ASIC to be reimbursed for any amount it paid Premera, when ASIC's liability could have been worse. BCS has not supplied any supporting authority for this proposition; and furthermore, the Court notes that it is BCS that has, to date, paid nothing towards its insured's losses, despite having issued a policy that follows form to the two carriers below it, which have both contributed the entirety of their $10 million limit. Whether BCS is liable for the AG payments, discussed infra, is a legal matter; but the Court finds that as an equitable matter, BCS is not entitled to avoid any liability it might have in this case. Instead, the equities here align quite easily with the law; if the ASIC policies provide coverage, ASIC should be liable for that coverage. If, however, the ASIC policies do not provide coverage (as this Court has in fact already determined with respect to the AG settlements), it is most equitable for any insurer whose policies do provide coverage to pay its fair share. In other words, equity favors BCS reimbursing ASIC for the amount ASIC paid to Premera toward the AG settlements, if the BCS policy provides coverage therefor.
2. Whether BCS Policy Provides Coverage for AG Settlements
Separate and apart from its equity arguments, BCS also denies that its policy provides coverage for the AG settlements. The relevant policy provision states, “[t]he Underwriter will pay on behalf of the Insured any Loss which the Insured is legally obligated to pay as a result of any Claim that is first made against the Insured.” Compl., Ex. F at 375. A “Loss” is defined as “any monetary amount which an Insured is legally obligated to pay as a result of a Claim” related to “maintaining the confidentiality of information regarding Medical Services or information obtained in the provision of Managed Care Services and limiting the release or use of such information in conformance with requirements of law.” Id. at 377. BCS does not deny that on its face, the insuring clause would provide coverage for the AG settlements.
Instead, BCS argues that the loss here is excluded under a subsequent exclusionary clause, which provides that a “Loss shall not include [] fines, penalties or taxes” and as BCS correctly notes, this Court has already ruled that the AG settlements payment was for “fines and penalties.” Id.; see Jan. 7, 2002 Order. The policy also goes on to say, however, that a “Loss shall include fines and penalties imposed under [HIPAA] or any similar local, state or federal privacy statute or regulation.” Id. (emphasis added). ASIC argues that because the AG settlements payment was in fact “imposed under [HIPAA] or any similar local, state or federal privacy statute,” the fines and penalties exclusion does not apply, and BCS is liable for the AG payments.
BCS attempts to evade the HIPAA exception to the fines and penalties exclusion by claiming that “ASIC did not reimburse Premera for HIPAA fines or penalties, but rather fines and penalties under state consumer protection statutes, which are not similar to HIPAA and thus do not constitute covered Loss under the E&O policies.” BCS Mot. at 27-28. Based upon the Court's review of the state AG complaints, however, nearly every complaint includes claims for violations of HIPAA; the two states that did not include a HIPAA claim brought claims under a “similar state privacy statute.” See generally Guite Decl., Ex. B; see also Florida Compl., id., at 262-71 (claiming violation of Florida Information Protection Act); Indiana Compl., id. at 373-84 (claiming violation of Indiana Disclosure of Security Breach Act). ASIC has thus met its burden of demonstrating that the state AG claims-and therefore, Premera's payment in settlement of those claims-fell under the HIPAA exception to the “fines and penalties” exclusion, and were covered under the BCS policy. That the states also made purportedly non-covered claims does not alter this conclusion. As BCS itself observes, “[w]here a settlement resolves covered and uncovered theories of liability that arise from the “same factual core,” allocation of the settlement is not permitted.” BCS Mot. at 9 (citing Public Utility Dist. No. 1 of Klickitat County, 124 Wn. 2d at 810; Nordstrom, 54 F.3d at 1430; In re Feature Realty Litig., 634 F.Supp.2d 1163 (E.D. Wash. 2007).
BCS attempts to muddy the conclusion that every state imposed “fines and penalties” under HIPAA or a similar privacy statute, through a complex analysis of several of the state settlements. It argues, for example, that only $850,000 of the $5.4 million Washington settlement can possibly be attributed to HIPAA violations, and that therefore the remaining amount Premera paid Washington must be based on the Washington CPA claims, which BCS argues is not covered under its policy. BCS also engages in some qualitative reasoning, asserting that several state AGs were “focused primarily on enforcement of state law requirements.” For example, BCS argues, the “emphasis in the [Oregon] complaint and the settlement agreement are on non-HIPAA, state-based consumer protection laws,” purportedly not covered under the BCS policy.
BCS Mot. at 29. BCS offers the bold and strikingly arbitrary proposition that “[g]iven that the settlements with the State AGs were consumer protection statute driven, at least 51% of the remaining State AG settlement payments should be allocated to non-HIPAA fines and penalties.”
The Court declines to engage in the type of speculative allocation BCS is proposing. Even if Washington law authorized such allocation, which as a general matter it does not, BCS's calculations are based entirely on speculation, and are unreliable. ASIC paid Premera $2.7 million of the total $10 million Premera paid in settlement of the AG lawsuits. Nothing in the record, however, indicates in what way that $2.7 million should be allocated (e.g. only towards the Washington settlement; or only towards claims of those states asserting a violation of a state privacy statute); nor, with the apparent exception of the California settlement, do Premera's settlements with the states indicate towards which claims the settlement payments should be allocated. Given this absence in the record of explicit allocation to covered and non-covered claims, related either to the ASIC-Premera settlement or the Premera-AG settlements (again, other than California), any post hoc allocation-no matter how expertly crafted-would be speculative, most certainly inaccurate, and, therefore, impermissible under Washington law. In re Feature Realty Litig., 634 F.Supp.2d 1163, 1172 (E.D. Wash. 2007) (allocation of “judgment amongst covered and non-covered theories of liability is impossible since no portion of [insured's] damages were uniquely attributable to the non-covered statutory claim.”); Providence Health & Servs. v. Certain Underwriters at Lloyd's London, 440 F.Supp.3d 1223, 1229 (W.D. Wash. 2020) (“Washington case law precludes allocation of damages to a non-covered claim where, as here, the damages in question were recoverable both under a covered theory and an uncovered theory.”). Because it is indisputable that BCS's policy covers at least some (likely large) portion of ASIC's indemnity for the state AG settlements-that is, those payments attributable to HIPAA fines and penalties, implicated in nearly all of the state AG complaints-BCS is liable for the entire amount that ASIC is seeking.
D. ASIC'S Motion to Exclude
ASIC filed a Motion to Exclude the Report and Testimony of Iliana Peters. See Dkt. No. 121. BCS filed the purported expert opinion in support of its Motion for Summary Judgment. ASIC's motion is improvidently filed. See Local Rule 7(g) (“Requests to strike material contained in or attached to submissions of opposing parties shall not be presented in a separate motion to strike, but shall instead be included in the responsive brief.”). In addition, the Court did not rely on the Peters opinion in its holding; the motion is therefore also moot. For these reasons, the Court strikes ASIC's Motion to Exclude.
IV. CONCLUSION
For the foregoing reasons, the Court grants in part and denies in part both parties' Motions for Summary Judgment. Specifically:
BCS has a duty to indemnify Premera, and therefore ASIC, for the $2,305,350 payment that ASIC made towards Premera's settlement of the state AG lawsuits;
ASIC is not entitled to subrogation against BCS for the approximate $12 million payment ASIC made to Premera towards Premera's settlement of the MDL lawsuit; the remaining claims in ASIC's Complaint are hereby dismissed; and
ASIC's Motion to Exclude is stricken.