New Jersey Insurance Coverage Litigation

Claims-made policies were supposed to simplify things.  In an article a few years back, insurance expert Fred Fisher noted that the idea behind such policies was to provide greater actuarial certainty for insurance companies, by ensuring that there would be no more claim activity following the end of a policy period (eliminating the “incurred but not reported” problem under occurrence-based policies).

But, of course, we humans are experts at complicating the simple.  One bedeviling issue under claims-made forms can be:  When is a “claim” actually “made”?  Specifically, when can claims be deemed “related”, so that a later claim outside the policy period is so closely tied to a prior claim inside the policy period that both are covered?  This tricky issue recently surfaced in a federal court case in Washington state involving EPLI and D&O coverage and a whistleblower claim.

Facts: Richard Klein was the CFO of a biopharma company called Omeros.  Klein claimed that Omeros unlawfully terminated him for internally reporting financial irregularities relating to a grant supervised by the National Institutes of Health.  Under a reservation of rights, Carolina Casualty defended a whistleblower lawsuit brought by Klein, and apparently spent over a million dollars in fees doing so.

During discovery in his lawsuit, Klein learned of additional facts that he felt supported a qui tam claim on behalf of the United States.  He moved to amend his complaint, asserting that Omeros had violated the federal False Claims Act.  The motion to amend was filed after Carolina Casualty’s policy period had ended.  Carolina Casualty agreed to defend Klein, again under a reservation of rights, but later filed a declaratory judgment action arguing in part that the qui tam claim was not covered.  The question was whether the qui tam claim “related back” to Klein’s original complaint, and therefore fell within the Carolina Casualty D&O policy.  That policy provided, in part, that “all claims based upon or arising out of the same Wrongful Act, or one or more series of any similar, repeated or continuous Wrongful Acts or Related Wrongful Acts, shall be considered a single claim.”

Carolina Casualty argued that the two claims were separate and distinct, in part because (A) the retaliation claim sought recovery for damage to Klein personally, while the qui tam claim sought recovery for damage to the government; and (B) the retaliation claim did not require Klein to prove that Omeros actually made false claims, while the qui tam claim did require Klein to do so.

But the Court rejected the carrier’s arguments, writing:  “This court holds that the qui tam claim and the anti-retaliation claim Mr. Klein raised in his initial complaint are based on related wrongful acts.  As the court has already noted, Mr. Klein’s initial complaint discloses his belief that Omeros made false claims.  That he chose not to pursue a qui tam claim based on that belief is immaterial, what matters is whether the qui tam claim is (in the language of the policy) ‘logically…connected’ to the anti-retaliation claim by reason of ‘any common fact, circumstance, situation, transaction, casualty, event or decision.’…Omeros’s alleged false reporting is a common event that logically connects the anti-retaliation and qui tam claims.” According to the Court, “Any common fact or event is sufficient to make two wrongful acts related.”  So, a win for the policyholder.

This ruling reminded me of two tangentially related insurance items (or concepts).

First, when determining whether the duty to defend exists, carriers aren’t supposed to depend on labels; they’re supposed to assess the substance of what’s being alleged.  As the New Jersey Supremes have written:  “Insureds expect their coverage and defense benefits to be determined by the nature of the claim against them, not by the fortuity of how the plaintiff, a third party, chooses to phrase the complaint against the insured. To allow the insurance company ‘to construct a formal fortress of the third party's pleadings and to retreat behind its walls, thereby successfully ignoring true but unpleaded facts within its knowledge that require it, under the insurance policy, to conduct the putative insured's defense’ would not be fair.”  SL Indus. v. Am. Motorists Ins. Co., 128 N.J. 188, 198-99 (1992) (citations omitted). 

Since Klein’s claims all stemmed from alleged financial improprieties engaged in by Omeros with respect to government work, wouldn’t Omeros reasonably expect the claims to be “related” for purposes of determining coverage?

Second, remember the protracted insurance fight over whether the World Trade Center attacks constituted one “occurrence” or “event,” or two?  As this 2004 article points out, the resolution of that issue depended upon the policy form being used, and also upon the jury deciding the issue.  Which leads me to the following question:  if the insurance company can’t obtain summary judgment on a coverage claim, doesn’t that mean that the policy can be reasonably interpreted in more than one way?  And if so, isn’t the policy by definition “ambiguous”?  (Ambiguities are supposed to be construed in the policyholder’s favor.)   The dictionary seems to say so.  But what does Webster know, anyway?

You can read the full Omeros decision by clicking here.  

I greatly respect judges.  And, I feel sympathy for judges. They have a very difficult job. We hand them enormous caseloads for relatively low pay (most of them could make a lot more money in private practice) and then expect them to become conversant in every legal subject imaginable, from water rights to alimony.  By way of comparison, I’ve been studying the ins and outs of insurance law for almost 30 years and I still haven’t mastered them (and probably never will).

Sometimes, though, judicial inexperience with the arcane aspects of law can lead to unintended and potentially serious consequences.  I think that this may have been the case with the recent decision in Federal Ins. Co. v. Sandusky.

By now, we’re all familiar with the sordid and shocking story behind the Penn State scandal.  A famous and highly regarded football coach at a major university runs a charity for underprivileged kids, named “The Second Mile.”  He uses the charity as a means of making contact with young boys, and then sexually abuses them.  He’s convicted and sentenced to 30 to 60 years in prison. 

The Sandusky affair has an insurance component.  Sandusky (the pedophile coach) filed claims under The Second Mile’s D&O and EPLI coverages for the civil and criminal charges brought against him.  The D&O coverage provided the familiar protection against “’loss’ which an insured person becomes legally obligated to pay for a wrongful act committed, attempted or allegedly committed by an insured person.”  The D&O coverage was limited to “wrongful acts” committed by those acting in an “insured capacity.”  The EPLI coverage required Federal to pay “loss on account of any third party claim,” including claims for “conduct of a sexual nature.”  Similar to the D&O requirement, for there to be coverage, the wrongdoing must have been committed “by an insured person in his or her capacity as such.”

The court denied both defense and indemnity to Sandusky, writing as follows:  “It is clear that Defendant Sandusky was not acting in his capacity as an employee or executive of The Second Mile in sexually abusing and molesting the victims named in the civil and criminal cases brought against him.”   (One thing I’ve learned over the years:  when a lawyer or judge uses the words “clear” or “clearly,” the situation is usually anything but.) The court analogized to cases dealing with the scope of employment for purposes of determining governmental immunity, writing:  “Conduct of an employee is within the scope of employment if it is of a kind and nature that the employee is employed to perform; it occurs substantially within the authorized time and space limits; it is actuated, at least in part, by a purpose to serve the employer; and if force is intentionally used by the employee against another, it is not unexpected by the employer.”

Since sexual abuse is not conduct “of a kind and nature” that The Second Mile hired Sandusky to perform, the reasoning goes, no coverage.  Implied:  Besides, Sandusky is a monster who should rot in hell.  (I happen to agree with that last part.)

Let’s divorce emotion from this for a moment and think it through.  When, if ever, would sexual harassment be conduct “of a kind and nature” that the employee is hired to perform?  Never, of course.  So what happens, for example, if a manager is falsely accused of sexually harassing a subordinate, and has to incur tens of thousands of dollars defending himself or herself in court?  Under the Sandusky court’s flawed logic, there apparently would be no defense coverage for such a suit, because sexual harassment is not within the manager’s job description.  But if that’s true, then EPLI insurance (and D&O insurance, when applied to particularly egregious acts) is just a ripoff.

What’s frustrating about this case is that the court could have based its decision based on other grounds raised by Federal, and not muddied the “scope of employment” issue.  Federal had argued that Sandusky was collaterally estopped from claiming coverage, because he had been adjudicated guilty of sexual abuse, and it was against the public policy of Pennsylvania to insure sexual abuse.  Had the court gone that route, the defense obligation would have been preserved for appropriate cases (until actual excluded bad acts are actually proven), and indemnity would have been precluded for those policyholders adjudicated guilty of intentional and egregious wrongdoing.  Presumably, that is the scenario envisioned by the carriers when rating these kinds of policies.

This type of shortsightedness is what led to the Burd v. Sussex [56 N.J. 383 (1970)] line of cases in New Jersey.  In Burd, the policyholder kneecapped someone with a shotgun, was convicted of atrocious assault and battery, and then sought coverage under his homeowner’s policy for the ensuing civil suit.  The court wrote: “[T]he carrier should not be permitted to assume the defense if it intends to dispute its obligation to pay a plaintiff's judgment, unless of course the insured expressly agrees to that reservation.”  (Emphasis added.)  If the policyholder does not agree to the reservation, then the duty to defend is converted to a duty to reimburse if and when coverage is proven.  And, that’s fine.  That does not destroy the defense obligation.  

But the Burd ruling – which is meant to protect policyholders from carrier conflicts - has been transformed by some carriers into a position that no immediate defense is required whenever there are allegations of intentional harm, regardless of whether the policyholder agrees to a reservation.

Worse, Burd has now been bastardized into the following dicta by the New Jersey Supreme Court:  “In an effort to fashion a practical remedy, and aware of the implications that arise because of the insurer's divided loyalties, the [Burd] Court concluded that the insurer had two options. That is, the insurer could assume the defense if the insured agreed, with a reservation of its right to dispute coverage, or it could refuse to defend and dispute its obligations thereafter, so as to ‘translate its obligation into one to reimburse the insured if it is later adjudged that the claim was one within the policy covenant to pay.’”    Flomerfelt v. Cardiello,  202 N.J. 432,  997 A.2d 991, 999 (2010).

Where, I ask you, does Burd say that the carrier, and not the policyholder, has the “options”?  Answer:  Nowhere.   And if the carrier has the “options” of (A) defending under a reservation of rights, or (B) not defending at all, which “option” do you think the carrier will select? 

I hope that, in the future, courts will take into consideration the purpose of the duty to defend (protection against litigation, even and perhaps especially when bad acts have been alleged) and the fact that carriers charge premiums accordingly.  For now, with full respect to all of the judges involved in these decisions, all I can say is that bad facts make bad law.

You can read the full Sandusky decision by clicking here.

If an insurance company wrongfully denies a third-party liability claim, then, under the New Jersey Court Rules (R. 4:42-9(a)(6), to be exact), if the policyholder has to sue to enforce coverage for the claim, the policyholder is entitled to recover its attorneys’ fees.  Due to a weird quirk in the Court Rules, however, a policyholder currently is not entitled to recoup attorneys’ fees on a wrongfully denied first-party claim.  Since a bad faith ruling is very difficult to obtain in New Jersey on a first-party claim (many judges deem any investigation to be a good investigation), there’s little disincentive for a carrier to drag out a first-party claim indefinitely (perhaps in the hope that an unnoticed internal one or two-year limitations period in the policy will pass).  (For those not familiar with insurance terminology, “first party” coverage applies to damage to your own property; “third party” coverage applies to claims brought against you for damage to someone else’s person or property.)

There’s now a proposed bill in the New Jersey Senate, S-2460, that would allow policyholders (both corporate and individual) a private right of action under New Jersey’s Unfair Claims Settlement Practices Act (“UCSPA”), N.J.S.A. 17:29B-4(9).  Under this bill, if the policyholder can establish a violation of UCSPA, such as refusing to pay a claim without a reasonable investigation based upon all available information, the policyholder would be entitled to relief including punitive damages and “reasonable attorney’s fees.”  The sponsors of the bill are Sen. Nicholas P. Scutari (D-Middlesex, Somerset and Union) and Sen. Jennifer Beck (R-Monmouth).  The relief would apply in both the first- and third-party context.  The insurance industry’s response to Sandy seems to be the driving factor behind the proposed law.

This is a new version of a bill that Sen. Scutari had proposed some time ago, and that died on the vine.  I assume that this one will meet a similar fate, since the insurance industry has a powerful lobby and I have it on good authority from a legislative aide that the industry has already made its displeasure with the bill known.  Truth be told, the only provision in the bill that I really care about is the ability of policyholders to recover their fees on first-party claims.  I think that an insurance contract establishes a quasi-fiduciary relationship, and there should be consequences when a carrier denies coverage wrongfully, or stalls on payment, in any context (first or third).  For a policyholder, especially a small business or individual, to have to finance a potentially expensive court battle with a recalcitrant insurance company is unfair and, in many cases, difficult if not impossible. Hopefully, eventually, this wrongheaded quirk in the Court Rules will be rectified, either by S-2460 or otherwise.

By the way, a number of states already already do allow for a private right of action under UCSPA.  Here’s a handy state-by-state survey.   

At the end of this month (January 26, to be exact), assuming that the Mayans remain incorrect, I’ll be doing a presentation to the New Jersey Institute for Continuing Legal Education on the topic of insurance coverage for cyberthreats.  Of course, I probably should be disqualified from making any comments whatsoever about trends in computer-related coverage, since I was a charter subscriber to the Mealey’s Y2K Litigation Reporter, the litigation world’s version of the Ford Edsel.

In any event, Willie Sutton is supposed to have remarked that he robbed banks because “that’s where the money is.”  (He denied making such a comment, but I’m not going to let the facts get in the way of a good story.)  Nowadays, the money is accessible without dynamite, drills or guns, to a new breed of criminal – so much so that the SEC now recommends that companies disclose the extent of their cybersecurity risks, including the availability of “relevant insurance coverage.”  (You can read the SEC guidance here.)  Liability associated with network security breaches is extreme.  According to one study of 137 events that took place between 2009 and 2011, the average total cost per incident was $3.7 million (including remedial costs and legal fees).     

I’ve previously blogged about Retail Ventures, Inc. v. National Union, 691 F.3d 821 (6^th Cir. 2012), in which a chain of shoe stores had its wireless network hacked, and the Court found coverage under a computer fraud rider to a blanket (first-party) crime policy.  You can read that post here.

I’d now like to review briefly an interesting cyberliability case involving third-party coverage, Eyeblaster, Inc. v. Federal Ins. Co., 613 F.3d 797 (8^th Cir. 2010).  (You can read the full Eyeblaster decision here.)  Facts: Eyeblaster is a marketing company that helps run advertising campaigns on the internet.  A computer user (Sefton) sued Eyeblaster, alleging that Eyeblaster injured his computer, software, and data after he visited an Eyeblaster website, through, among other things, the unauthorized installation of cookies on Sefton’s computer. Sefton contended that, after Eyeblaster did its thing, his computer slowed to a crawl and he had difficulty remediating the problem.

With respect to Eyeblaster’s general liability coverage, the issue was whether there had been damage to “tangible property,” so as to trigger property damage coverage.  The Court said yes,  writing as follows:  “Federal did not include a definition of ‘tangible property’ in its General Liability policy, except to exclude ‘software, data or other information that is in electronic form.’ The plain meaning of tangible property includes computers, and the Sefton complaint alleges repeatedly the ‘loss of use’ of his computer. We conclude that the allegations are within the scope of the General Liability policy.”

What we see here is that, at least under general liability policies, hardware tends to be viewed as more “tangible” than software, so that if there are allegations of any harm to hardware, there’s more likely to be coverage.

Along these lines, for those of you who may be dealing with cyberliability issues under standard liability policies, keep in mind that there are ISO exclusions that may apply.  The 2001 version of the exclusion reads: “For purposes of this insurance, electronic data is not tangible property.”  The 2004 version of the exclusion excludes ”[d]amages arising out of the loss of, loss of use of, damage to, corruption of, inability to access or inability to manipulate electronic data.”  Even if the 2004 exclusion had been in play in Eyeblaster, however, the Court likely would have found coverage.  The Eyeblaster Court focused on the idea that the hardware itself did not work, as opposed to electronic data (which may be an intangible concept) being corrupted.

As to the E&O coverage, Federal argued that there was no coverage for intentional acts, even if they result in unintentional damage.   The Court disagreed with that argument as well, writing:  “Sefton alleges that Eyeblaster installed tracking cookies, Flash technology, and JavaScript on his computer, all of which are intentional acts. However, Federal can point to no evidence that doing so is intentionally wrongful. As Eyeblaster points out in an affidavit filed with the district court, Federal's parent company utilizes JavaScript, Flash technology, and cookies on its own website. Federal cannot label such conduct as intentionally wrongful merely because it is included in the Sefton complaint; Federal has a duty to show that the use of such technology is outside its policy's coverage.”  (I always admire good lawyering; going to Chubb’s website and finding similar applications there was a nice touch.)

There are, of course, new insurance products coming onto the market specifically to deal with cyberliability issues, such as Marsh’s “Cloud Protect,” which is designed to protect small and midsized businesses against losses stemming from a cloud service provider’s failure.  When reviewing any of the new policies, pay specific attention to the definition of the terms “computer system” or “computer network,” to make sure that what you want to have covered, is in fact covered.

New York’s highest court issued an interesting decision last week on the professional duties of insurance brokers.  This is a topic of renewed interest following Sandy, as I’m sure that more than a few policyholders will claim that their brokers provided them with insufficient coverage to weather the storm (pun intended).  I know, for example, that carriers are denying claims out on the Barrier Islands without even bothering to send out adjusters, so there are going to be a lot of unhappy policyholders around.

The policyholder in the New York case, American Building Supply, sells building materials to general contractors, and is the sole tenant in a subleased building which is used only by ABS employees and not open to the general public.  ABS claimed that, in discussions with its broker, it specifically requested general liability coverage for its employees in the event of injury.  Unfortunately, the policy involved in the case contained a cross-liability exclusion clause that provided in part:  “This insurance does not apply to any actual or alleged ‘bodily injury’…to…a present, former, future, or prospective partner, officer, director, stockholder, or employee of any insured.”  Neither the broker nor ABS actually read the policy when it was sold.  And you can guess what happened next:  an injured employee and a denial of liability coverage.

The broker (Petrocelli) attempted to defend the resulting malpractice suit by arguing that ABS was itself negligent, by failing to read and understand the policy it purchased.   The Court disagreed with that position, writing:  “The failure to read the policy, at most, may give rise to a defense of comparative negligence but should not bar, altogether, an action against a broker.” The Court also wrote:  “To set forth a case for negligence or breach of contract against a broker, a plaintiff must establish that a specific request was made to the broker for the coverage that was not provided.”  Here, issues of fact existed as to whether ABS had specifically requested coverage for its employees in the case of accidental injury, so the appeals court sent the case back to the trial court for resolution of that issue. 

In rendering its decision, the Court noted that Petrocelli’s position was illogical:  “Since no one but employees ever entered the premises, the coverage [Petrocelli] obtained, which excluded coverage for injuries to employees, hardly made sense.” 

You can read the full ABS case by clicking here.

The rule in New Jersey is slightly different.  The key New Jersey case is Aden v. Fortsh, 169 N.J. 64 (2001).   In Aden, the husband-and-wife policyholders bought a $48,000 condo and contended that they asked Fortsh, an insurance broker, to cover both the condo and $16,000 in contents.  Fortsh contended that he advised the Adens to consult the condo association policy to make sure that anything not covered by the policy he sold would be covered by the association’s policy.  As an aside, the first policy that Fortsh offered had a $120 annual premium, which the Adens rejected as too expensive.  Fortsh then got the Adens a policy with a $98 annual premium.  (Note to professionals:  when clients nickel-and-dime, there’s trouble just over the horizon.)  Fortsh completed the application for the policy and signed it with the Adens’ permission (a mistake in retrospect, since had the Adens signed it, the subsequent malpractice case would have been harder to sustain). Unfortunately, the policy had only $1000 in total coverage.

The Adens never read the policy.  A fire happened, and they had to pay $20,000 for repairs out of their own pocket.  Result:  malpractice suit.

The Court said that the Adens’ failure to read the policy didn’t matter:  “To hold that an insured must read the policy, and therefore is not entitled to rely on the broker’s expertise… would make the insured responsible for ‘self-inflicted harm,’ despite the broker’s express obligation to protect the insured from that harm…A broker is not an ‘order taker’ who is responsible only for completing forms and accepting commissions.”

The Court noted that its ruling would not preclude brokers from arguing that the policyholder’s failure to read the policy was the true cause of the harm.  But, the Court said, the broker’s lawyer had tried to do just that at trial, and the jury had rejected his efforts.  The Court wrote:  “Even had he read the policy, [Aden] would have been entitled to assume that the $1000 in dwelling coverage was sufficient coverage in light of Fortsh’s professional obligation to ensure that the condominium association’s policy and the policy he was procuring for Aden, in the aggregate, provided adequate coverage.”

You can read the full Aden decision by clicking here.

Here’s my take on all this.  Insurance policies are often a bewildering forest of arcane and discordant trees and weeds.  (From my perspective as a coverage lawyer, thank heaven for that!) Expecting policyholders to understand them when judges can’t agree on what they mean is usually downright nutty.  The best practice is for a broker to take the time at least to review the declarations page carefully, go over it with the client, and make sure everyone's on the same page.