Atlantic Specialty Insurance Company v. Lexington Insurance Company ( 2022 )

2 3 4 5 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 6 AT SEATTLE 7 ATLANTIC SPECIALTY INSURANCE NO. 2:21-cv-0616-BJR COMPANY, 8 Plaintiff, ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 9 v. 10 LEXINGTON INSURANCE COMPANY and BCS INSURANCE COMPANY, 11 Defendants. 12 13 I. INTRODUCTION 14 This matter comes before the Court on cross Motions for Summary Judgment brought by, 15 respectively: (1) Defendant BCS Insurance Company (“BCS”); and (2) Plaintiff Atlantic 16 Specialty Insurance Company (“ASIC”). See Dkt. Nos. 118, 120. BCS seeks dismissal of the 17 ASIC Complaint in its entirety. ASIC seeks a declaration in its favor that: (1) BCS has a duty to 18 indemnify the parties’ mutual insured, nonparty Premera Blue Cross (Count I); ASIC has no duty 19 to indemnify Premera pursuant to its insuring agreements (Count II); and ASIC has no duty to 20 indemnify Premera pursuant to several exclusionary clauses in the policies (Counts III-V). ASIC 21 seeks judgment for contractual and equitable subrogation against BCS. (Count VI). Having 22 reviewed the parties’ briefs filed in support of and opposition to both motions, and the exhibits 23 filed in connection therewith, the Court finds and rules as follows. 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 This insurance coverage dispute arose out of claims against the parties’ mutual insured, 3 nonparty Premera Blue Cross. In early 2014, computer hackers were able to access Premera’s 4 computer network, resulting in a massive data breach that compromised the private financial and 5 health information of over 10 million Premera customers and employees. The breach led to the 6 filing of a number of lawsuits against Premera, including a multidistrict litigation action (the 7 “MDL lawsuit”) and lawsuits brought by 30 state attorneys general (the “AG lawsuits”). In sum, 8 the lawsuits claimed that Premera had breached a duty to protect consumers’ confidential data, 9 resulting in damages totaling millions of dollars. 10 Premera turned to its insurance carriers for coverage. Premera’s coverage included two 11 layers of cyber security insurance; a primary comprehensive general liability (CGL) policy and 12 general liability umbrella policy, both issued by ASIC; and several layers of managed care errors 13 and omissions (“E&O”) insurance, including a secondary excess E&O policy issued by BCS. In 14 late 2015, ASIC filed a lawsuit in this Western District, seeking a declaration that it was not liable 15 for Premera’s defense costs or its ultimate liability, related to either the MDL or the AG lawsuits. 16 See Atl. Specialty Ins. Co. v. Premera Blue Cross, No. C15-1927TSZ (“ASIC v. Premera”). The 17 Hon. Thomas Zilly, ruling on a motion for summary judgment, held that ASIC had a duty to 18 defend Premera in the MDL action, concluding that at least one of the MDL claims against 19 Premera (for negligence) was “conceivably covered” under the two ASIC policies. ASIC v. 20 Premera, 2017 WL 11600056, *6 (W.D. Wash. July 12, 2017) (“2017 Order”). The Court did not 21 determine at that time whether ASIC had an obligation to defend Premera in the AG action, or a 22 duty to indemnify Premera for the AG or MDL actions, and stayed the coverage case pending 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 and the 30 AG lawsuits for a total of $10 million. See 30 AG Compls. and Consent Js. at Ex. B to 3 Decl. of Robert J. Guite, Dkt. No. 120-9; MDL Compl. and Settlement Agmt. at Exs. A & B to 4 Compl., Dkt. No. 1-1. 5 ASIC subsequently agreed to pay Premera a total of $14.7 million under the CGL and 6 umbrella policies: approximately $12 million towards the MDL settlement and $2.7 million 7 towards the AG settlements.1 See Compl., ¶¶ 6, 8; Decl. of Cara Tharp, Dkt. No. 120, and Exs. A, 8 B &D thereto. ASIC made those payments subject to a reservation of the right to seek subrogation 9 against Premera’s other insurers. Compl. ¶¶ 6, 8. It later filed the instant lawsuit against two of 10 Premera’s E&O insurers: former Defendant Lexington Insurance Company (excess to a primary 11 E&O policy issued by nonparty Ironshore Insurance Company), and BCS (secondary to the 12 Lexington policy). Both the BCS and Lexington policies follow form to the Ironshore policy and 13 are operatively identical for purposes of this lawsuit. 14 Ruling on cross motions for judgment on the pleadings, this Court ruled that the ASIC 15 policies did not provide coverage for the AG settlement, as those policies contained an exclusion 16 for “fines and penalties,” and the AG settlement payments fit within the commonsense definition 17 of “fines and penalties.” See Order Re: (1) ASIC’s Mot. for Part. J. and (2) BCSI’s Mot. for J. on 18 the Pldgs., Dkt. No. 98 (“Jan. 7, 2022 Order”). ASIC subsequently settled with Lexington for 19 $394,650, and as a result, Lexington has now paid the $10 million limit of its policy, triggering 20 BCS’s obligation for any remaining liability under its secondary excess E&O policy. See Guite 21 22 1 Premera’s primary and excess cyber security insurance carriers paid the limits of their policies, totaling $20 million; its E&O primary carrier paid its limit of $10 million, and former Defendant Lexington agreed to pay 23 $9,605,350, short of its $10 million limit. 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 ASIC seeks subrogation against BCS for the full $10 million limit of the BCS policy, 3 claiming it is entitled, as Premera’s subrogee, to indemnity for both the MDL and the AG 4 lawsuits. 5 III. DISCUSSION 6 A. Standard for Summary Judgment, Subrogation, and Duty to Indemnify Liability for Settled Claims 7 Summary judgment is appropriate where “the movant shows that there is no genuine 8 dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. 9 Civ. P. 56(a); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247 (1986). On a motion for 10 summary judgment, the court views the evidence and draws inferences in the light most favorable 11 to the non-moving party. Anderson, 477 U.S. at 255. 12 Interpretation of an insurance contract is a question of law. Overton v. Consol. Ins. Co., 13 145 Wn.2d 417, 424 (2002). When interpreting an insurance policy, courts consider the policy “as 14 a whole,” and “give it a fair, reasonable, and sensible construction as would be given to the 15 contract by the average person purchasing insurance.” Quadrant Corp. v. Am. States Ins. Co., 154 16 Wn.2d 165, 171 (2005) (citation omitted). 17 “Subrogation” is “[t]he principle under which an insurer that has paid a loss under 18 an insurance policy is entitled to all the rights and remedies belonging to the insured against a 19 third party with respect to any loss covered by the policy.” Mut. of Enumclaw Ins. Co. v. USF Ins. 20 Co., 164 Wn. 2d 411, 423 (2008) (quoting Black’s Law Dict. 1467 (8th ed. 2004)). “Subrogation 21 is an equitable doctrine the essential purpose of which is to provide for a proper allocation of 22 payment responsibility. It seeks to impose ultimate responsibility for a wrong or loss on the party 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 (1998). To demonstrate it is entitled to subrogation, ASIC, standing in the insured’s shoes, has the 3 ultimate burden of establishing that the underlying claims resolved pursuant to the MDL and AG 4 settlements fall within the coverage provided by the BCS E&O insurance policy. See In re 5 Feature Realty., 468 F. Supp. 2d 1287, 1293–94 (E.D. Wash. 2006). 6 For cases such as this one concerning an insurer’s liability arising out of the insured’s 7 settlement of a lawsuit, the standard has been carefully articulated by Washington courts; “in an 8 action to collect insurance proceeds after a settlement, payment is proper as long as the claim is 9 shown to be within the scope of policy coverage.” Pub. Util. Dist. No. 1 of Klickitat Cnty. v. Int'l 10 Ins. Co., 124 Wn. 2d 789, 809 (1994). Importantly, an insured does not need to prove that had it 11 not settled, it would have been found actually liable in the underlying lawsuit. Nordstrom, Inc. v. 12 Chubb & Son, Inc., 820 F. Supp. 530, 535 (W.D. Wash. 1992) (“[T]he insured need not establish 13 actual liability to the party with whom it has settled to recover the amount of settlement from the 14 insurer, so long as potential liability is shown to exist on the facts known to the insured.”). 15 Instead, after a settlement, the question of whether an insurer must pay the insured’s liability (i.e. 16 the settlement amount), centers on whether the underlying claims against the insured, for which it 17 was potentially liable, were of a type actually covered under the policy. Id. (court “need only 18 determine that the [insureds] faced a potential liability in the underlying action, and that the 19 settlement reasonably approximated their estimated exposure to liability.”). Such inquiry may be 20 resolved based on claims articulated in the complaint, and the language of the settlement. Sentry 21 Select Ins. Co. v. Alaska Nat’l Ins. Co., No. C01-1956RSM, 2005 WL 8165075, *4 (W.D. Wash. 22 Jan. 13, 2005) (“It is well settled that ‘[w]here an action settles prior to trial ... the duty to 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 the underlying complaint and those known to the parties.’”) (citation omitted). 3 B. Whether ASIC Is Entitled to Subrogation Against BCS Related to the MDL Settlement 4 1. Whether the ASIC policies provide coverage for MDL settlement 5 BCS argues that ASIC is not entitled to subrogation for the $12 million ASIC paid 6 towards Premera’s MDL settlement, because that liability is in fact covered under “Coverage B” 7 of ASIC’s policies. Coverage B provides that ASIC “will pay those sums that the insured 8 becomes legally obligated to pay as damages because of ‘personal and advertising injury.’” 9 Compl., Ex. E-1, at 268. The policies define “personal and advertising injury” to include an injury 10 “arising out of,” among other events, the “[o]ral or written publication, in any manner, of material 11 that violates a person’s right of privacy.” Id., at 276. BCS argues that the MDL claims based on 12 the data breach fit within the definition of “publication,” and that ASIC was therefore liable for 13 the coverage. 14 ASIC disputes that the MDL settlement was a “personal and advertising injury” within the 15 meaning of the policies. In support of this position, ASIC proposes a limited construction of the 16 term “publication,” which is not defined in the policy. According to ASIC, to be a covered injury 17 under the personal and advertising provision of the CGL and umbrella policies, the material must 18 have been published a) by Premera, the insured, not by a third party (e.g. in this case, the 19 computer hackers); and b) to the general public, not to select parties to whom the data was 20 exposed. ASIC also argues that even if the personal and advertising injury coverage applies to the 21 facts of the Premera data breach, Coverage B contains several exclusions that apply to the facts of 22 the MDL lawsuit. The Court reviews each argument in turn. 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 BCS argues that the term “personal and advertising injury” includes coverage for 3 Premera’s settlement of the MDL claims, as the MDL plaintiffs essentially alleged the 4 “publication of material that violates a person’s right of privacy.” For example, the MDL’s claim 5 for negligence alleged that “Premera’s network-security procedures were inadequate” and “the 6 vulnerabilities could be exploited by hackers and expose sensitive information,” resulting in “the 7 illegal sale of the compromised data on the deep web black market.” MDL Compl. ¶ 174-75, Ex. 8 A to Compl. BCS argues these allegations are tantamount to a “publication” within the meaning 9 of the ASIC policies. BCS also points to the MDL plaintiffs’ breach of contract claim and their 10 claim for violation of the California Confidential Medical Information Act, which “prohibits 11 entities from negligently disclosing or releasing any person’s confidential medical information,” 12 as alleging a “publication of material that violates a person’s right of privacy.” See MDL Compl., 13 ¶¶ 178-209; 245-49, 248 (Premera “disclosed and released Plaintiffs’ . . . Sensitive Information to 14 hackers.”). 15 As noted, ASIC argues that the MDL was not premised on facts that could be construed as 16 a “publication,” because information belonging to the Premera customers was neither a) 17 disseminated by Premera, nor b) released to the general public. ASIC argues that any common- 18 sense definition of “publication” would require these elements, citing several dictionary 19 definitions of “publish” and “publication.” 20 This issue is identical to the one brought before the Hon. Thomas Zilly in ASIC v. 21 Premera, in which the Court was asked to determine whether ASIC had a duty to defend Premera 22 in the MDL lawsuit. The Court in that case concluded that “the negligence claim [in the MDL 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 ‘publication, in any manner, of material that violates a person's right of privacy,’” and that 3 therefore ASIC had a duty to defend its insured under the personal and advertising injury 4 provision. ASIC v. Premera, 2017 WL 11600056, at *5. 5 This Court is bound by the principles of issue preclusion, also known as collateral 6 estoppel, to follow this holding. Issue preclusion applies “when the party seeking estoppel is able 7 to show that ‘(1) the issue decided in the prior adjudication is identical with the one presented in 8 the second action; (2) the prior adjudication [resulted] in a final judgment on the merits; (3) the 9 party against whom [collateral estoppel] is asserted was a party or in privity with a party to the 10 prior adjudication; and (4) there is no injustice if the parties are prevented from relitigating the 11 issues.’” Lopez-Vasquez v. Dep't of Lab. & Indus. of State of Washington, 168 Wn. App. 341, 12 345 (2012) (quoting Thompson v. State, Dep't of Licensing, 138 Wn.2d 783, 790 (1999)). ASIC 13 argues only that the first element here is not met: that the issues are not “identical” because the 14 2017 Order concerned ASIC’s duty to defend, which as this Court has acknowledged is broader 15 than a duty to indemnify. See Jan. 7, 2022 Order at 10. 16 However, “[t]he ‘identical issue’ requirement [of collateral estoppel] addresses whether 17 ‘identical factual allegations’ are at stake in the two proceedings, not whether the ultimate issues 18 or dispositions are the same.” Hardwick v. Cnty. of Orange, 980 F.3d 733, 740 (9th Cir. 2020) 19 (citing Lucido v. Superior Court, 795 P.2d 1223, 1225 (Cal. 1990)); see also Christensen v. Grant 20 Cnty. Hosp. Dist. No. 1, 152 Wn. 2d 299, 319 (2004) (“This case involves issue prelusion, and the 21 same issue is involved, i.e., whether Samaritan discharged Christensen in retaliation for his union 22 activity. It does not matter that the claim or cause of action that Christensen seeks to pursue in 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 action].”) (citation omitted); White v. City of Pasadena, 671 F.3d 918, 926 (9th Cir. 2012) (“Issue 3 preclusion, in contrast [to claim preclusion], bars successive litigation of an issue of fact or law 4 actually litigated and resolved in a valid court determination essential to the prior judgment, even 5 if the issue recurs in the context of a different claim.”). In other words, the issue that must be 6 “identical” here for preclusion to apply is whether the MDL plaintiffs alleged a “publication” 7 within the meaning of the ASIC policies, not the ultimate issue of whether ASIC has a duty to 8 defend Premera. 9 Moreover, it is evident from a close reading of the 2017 Order that its holding was not 10 dependent upon the nature of the claim at issue, or limited by the legal standard governing the 11 duty to defend. The Court in ASIC v. Premera unqualifiedly held that “[t]he negligence claim in 12 the MDL matter alleges the requisite ‘publication.’” 2017 Order, 2017 WL 11600056, at *6. In so 13 holding, the Court squarely rejected both of the arguments ASIC repeats here. The Court 14 dispensed with ASIC’s argument that to warrant coverage, a publication must have been made by 15 Premera, observing that “[a]lthough Premera presumably did not intend to expose the class 16 members’ confidential information to hackers, it did so by allegedly failing to implement 17 adequate security measures, and the private data has undisputedly been made available to an 18 unknown number of individuals.” Id. Relying on precedent of “other courts . . . in the tort realm,” 19 the Court also held that “communication to a single individual might be sufficient,” and that “with 20 respect to ‘advertising injury,’ publication need not even be to a third party.” Id. The 2017 Order 21 unequivocally concluded that “[p]ublication occurs when information is placed before the public; 22 it does not require that anyone actually review the material.” Id. 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 duty to indemnify is further undermined because in this case, there is simply no daylight between 3 what the MDL plaintiffs claimed in their complaint, and what matters were resolved by settlement 4 of that lawsuit. See MDL Settlement, Ex. B to Compl., at 3 (expressly resolving “all claims and 5 causes of action asserted, or that could have been asserted against Premera”). ASIC is wrong 6 when it argues (without citation to authority) that “[t]o prove that the ASIC Policies covered the 7 MDL Settlement under the duty to indemnify standard, BCSI must prove that the data stolen from 8 Premera was actually ‘published;’ not simply that it was alleged to have been ‘published.’” ASIC 9 Resp. at 9. To the contrary, Washington law is clear that “the insured need not establish actual 10 liability to the party with whom it has settled to recover the amount of settlement from the insurer, 11 so long as potential liability is shown to exist on the facts known to the insured.” Nordstrom Inc., 12 820 F. Supp. at 535 (“An insurer is not entitled . . . to re-litigate an underlying action following a 13 settlement.”) (citing Luria Bros. & Co. v. Alliance Assurance Co., 780 F.2d 1082, 1091 (2nd 14 Cir.1986)). Accordingly, in this case the standard governing the duty to indemnify the settlement 15 is not materially distinct from that governing the duty to defend. In both cases, the question is 16 whether “‘potential liability’ is shown to exist on the facts known to the insured.” Id. 17 The Court also concludes in the alternative that even if the 2017 Order did not have a 18 technically preclusive effect, the reasoning of that case is sound and the holding is highly 19 persuasive authority. The policies themselves are silent as to both whether a “publication” must 20 have been committed by the insured, and whether it must have been made to the general public. 21 ASIC was certainly capable of limiting the definition of the term “publication” had it intended to 22 do so. See ASIC v. Premera, 2017 WL 11600056, at *6 (“If ASIC wished to limit coverage to 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 should have crafted the Policy accordingly.”) (citing Boeing Co. v. Aetna Cas. & Sur. Co., 113 3 Wn.2d 869, 887 (1990) (“The [insurance] industry knows how to protect itself and it knows how 4 to write exclusions and conditions.”); Park Univ. Enters., Inc. v. Am. Cas. Co. of Reading, Pa., 5 314 F. Supp. 2d 1094, 1106-09 (D. Kan. 2004) (“American did not define ‘publication’ in its 6 policy. If American intended to limit the scope of ‘publication’ to those materials sent to a third 7 party, it should have so-stated in the policy.”). As ASIC did not define or limit the term 8 “publication,” it cannot now claim that its proposed limitations should be read into the plain 9 meaning of the term. 10 The Court concludes that the MDL plaintiffs alleged, and ultimately settled with Premera, 11 a number of claims that fit within the definition of “publication” under the ASIC policies’ 12 “personal and advertising injury,” covered under Coverage B. 13 b. The Exclusion for “Recording and Distribution of Material or Information” 14 ASIC argues that even if the MDL settlement fits within the definition of a covered loss 15 (as the Court has concluded it does), ASIC is not liable for the MDL settlement because the 16 policies contained applicable exclusions. Under Washington law, “exclusions from coverage of 17 insurance are contrary to the fundamental protective purpose of insurance and will not be 18 extended beyond their clear and unequivocal meaning,” and should be “strictly construed against 19 the insurer.” Stuart v. Am. States Ins. Co., 134 Wn. 2d 814, 818-19 (1998). ASIC, the insurer, 20 bears the burden of demonstrating an exclusion applies. Mut. of Enumclaw Ins. Co., 165 Wn. 2d 21 at 268. 22 The first claimed exclusion is for coverage for “[t]he Recording and Distribution of 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 relevant part: 3 “Personal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate: 4 (1) The Telephone Consumer Protection Act (TCPA) . . . ; 5 (2) The CAN-SPAM Act of 2003 . . . ; 6 (3) The Fair Credit Reporting Act (FCRA) . . . ; or 7 (4) Any federal, state or local statute, ordinance or regulation, other than the TCPA, 8 CAN-SPAM Act of 2003 or FCRA and their amendments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, 9 recording, sending, transmitting, communicating or distribution of material or information. 10 Compl., Ex. E-1 at 269. ASIC argues that the fourth “catchall” subpart of the exclusion should be 11 read to include HIPAA, thereby excluding claims based on the MDL settlement. 12 BCS disputes that the RDI exclusion applies to the MDL claims. In support, BCS makes 13 two arguments: first, that the fourth subpart should not be read to include HIPAA; i.e., that the 14 RDI exclusion is not appropriately applied to claims arising out of HIPAA; and second, that even 15 if the RDI exclusion applies to HIPAA-related claims, the provision is not applicable here 16 because the MDL plaintiffs did not assert any claims under HIPAA (nor could they have, as the 17 statute does not provide a private right of action). 18 ASIC fails to dispute BCS’s first argument, either in response to BCS’s motion, or in 19 support of its own, and BCS claims ASIC has therefore conceded the point. In any event, the 20 Court finds again that Judge Zilly’s holding in ASIC v. Premera precludes relitigation of this issue 21 and is controlling. In that case, the Court was tasked with resolving the exact question posed 22 here—whether the fourth subpart of the RDI exclusion should be construed to include HIPAA— 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 construction [] requiring that general words, following an enumeration of specific words, [should] 3 be interpreted to embrace only items of a nature similar to the preceding specific words.” ASIC v. 4 Premera, 2017 WL 11600056, at *6. As applied to the RDI exclusion, the ejusdem generis 5 principle dictates that because HIPAA was not “of a nature similar” to the consumer-reporting 6 statutes explicitly referenced elsewhere in the exclusion, Premera “could not have reasonably 7 understood the catch-all provision [of the RDI exclusion] to incorporate alleged HIPAA 8 violations simply by virtue of the preceding reference to the FCRA.” The Court therefore held, 9 again broadly and without reference to, or limitation by, the duty to defend standard, that “to the 10 extent the class action plaintiffs in the underlying litigation assert HIPAA violations, any such 11 claims would not fall within the catch-all language of the violation-of-law exclusion.” Id. at *7. 12 For the reasons articulated above, the doctrine of issue preclusion applies to preclude relitigation 13 of this issue as well. 14 In addition, and alternatively to applying issue preclusion, the Court finds Judge Zilly’s 15 reasoning in ASIC v. Premera sound, and applies it to the same facts at issue here. The Court 16 finds that ASIC has failed to meet the burden, which the law places squarely with the insurer, of 17 demonstrating that its policy exclusion applies. ASIC was quite capable of adding HIPAA—a 18 statute that is practically a household word—to its list of statutes giving rise to a coverage 19 exclusion; it did not. Narrowly construing the exclusion against the insurer, the Court concludes 20 subpart (4) cannot be read to include HIPAA, and coverage of the MDL settlement was not 21 excluded under the RDI exclusion. 22 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 In the opening brief of its Motion for Summary Judgment, ASIC argues the “professional 3 services” exclusion, found in the policies’ Financial Institution Endorsement, applies to exclude 4 coverage of the MDL settlement. That exclusion provides “[t]his insurance does not apply to . . . 5 ‘personal and advertising injury’ arising out of the rendering or failure to render professional 6 services including but not limited to . . . [a]uditing or maintaining of accounts or records of 7 others” and “[a]cting in any capacity as a fiduciary or trustee.” Compl., Ex. E at 309. ASIC argues 8 the exclusion applies because the MDL plaintiffs alleged Premera failed to protect its customers’ 9 private information—in other words, the “accounts and records of others”—giving rise to the 10 security breach underlying the MDL claims. 11 The term “professional services” is not defined in the policy. BCS argues, however, that 12 the provision does not apply under these circumstances, because “to be considered a professional 13 service, the conduct must arise out of the insured's performance of his specialized vocation or 14 profession.” Bank of California, N.A. v. Opie, 663 F.2d 977, 981 (9th Cir. 1981) (quoted in BCS 15 Mot. at 20, emphasis added by BCS). “Professional services” in the insurance context do not 16 include “general administrative activities that occur in all types of businesses.” PMI Mortg. Ins. 17 Co. v. Am. Int'l Specialty Lines Ins. Co., 394 F.3d 761, 766 (9th Cir. 2005). BCS argues that the 18 “professional services” in which Premera “specializes” is the provision of health insurance, not 19 the maintenance of customer records, and that maintaining the security of customer records is just 20 the kind of ancillary “general administrative activity” that occurs in any business; it is not a 21 “professional service” in which Premera specializes but “failed to render.” Because the injury 22 23 2 ASIC did not attempt to invoke the Professional Services exclusion in ASIC v. Premera. 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 rendering or failure to render health insurance, BCS argues, the Professional Services exclusion 3 does not apply. 4 ASIC, inexplicably, fails to respond to BCS’s arguments, in the context of either party’s 5 motion. It therefore does not dispute that Premera’s “specialized vocation or profession” is 6 providing health insurance, or that maintaining the security of customers’ data is a “general 7 administrative activity” that occurs in any business, including Premera. Indeed, because neither 8 the underlying MDL settlement nor the ASIC settlement with Premera allocated any particular 9 amount of liability between covered and uncovered claims, unless the exclusion applied to all of 10 the claims resolved in the MDL lawsuit, under Washington law ASIC still has a duty to indemnify 11 the entire settlement, as all claims undisputedly arose out of the same factual core. Providence 12 Health & Servs. v. Certain Underwriters at Lloyd's London, 440 F. Supp. 3d 1223, 1229 (W.D. 13 Wash. 2020) (“Washington case law precludes allocation of damages to a non-covered claim 14 where, as here, the damages in question were recoverable both under a covered theory and an 15 uncovered theory.”). ASIC has failed to meet its burden of showing that the exclusion would 16 apply to all of the MDL claims. 17 The MDL plaintiffs did not allege claims arising out of Premera’s rendering or failure to 18 render health insurance. Cf. Planet Earth Found. v. Gulf Underwriters Ins. Co., 130 Wn. App. 19 1040 (2005) (because claims against insured, an advertising and public relations firm, arose from 20 its “alleged rendering or failure to render advertising and public relations, . . . they are covered by 21 the professional services exclusion.”). The Court concludes that the Professional Services 22 exclusion is therefore not applicable to Premera’s MDL settlement liability. 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 Because the Court concludes that the ASIC primary CGL and umbrella policies provided 3 coverage for Premera’s settlement of the MDL lawsuit, the Court need not decide whether the 4 BCS policy would have provided coverage for the MDL settlement. Subrogation is available only 5 when a party pays a debt that is not its own. In re Farmers’ & Merchants’ State Bank of 6 Nooksack, 175 Wn. 78, 86 (1933) (subrogation available to “those who pay the debt of another.”); 7 Nat’l Fire Ins. Co. of Hartford v. Com. & Indus. Ins. Co., 2017 WL 468575, *2 (W.D. Wash. Feb. 8 3, 2017). The Court has concluded that the debt did in fact belong to ASIC. ASIC is therefore not 9 entitled to subrogation against BCS, regardless of whether or not the BCS policy could be read to 10 provide coverage. 11 In response to BCS’s motion, and somewhat more obliquely in its own, ASIC makes an 12 argument for equitable contribution, positing that even if the ASIC policies do cover Premera’s 13 injury arising from the MDL settlement, ASIC is still entitled to reimbursement, because BCS’s 14 policy provides coverage as well. ASIC claims (without citation to authority) that “Washington 15 law holds that the BCSI Policy is primary to the ASIC Umbrella Policy.” ASIC Resp. at 14. 16 A claim for equitable contribution, however, is “entirely different” from a claim for 17 subrogation. Fireman’s Fund Ins. Co. v. Maryland Cas. Co., 65 Cal. App. 4th 1279, 1293, 77 Cal. 18 Rptr. 2d 296, 303 (1998). As this Court has plainly stated, ASIC did not state a contribution claim 19 in its Complaint, and therefore is not entitled to pursue one: 20 ASIC also argues in its motion that it is entitled to “contribution” from the two Defendants. ASIC did not assert a contribution claim in its Complaint, and for this 21 reason alone a ruling in its favor on such claim would be improper. Even if ASIC had stated a claim for contribution, as Defendants argue, such claim does not fit the 22 facts of the instant case. In its Reply, ASIC does not dispute Defendants’ position that ASIC is not entitled to “contribution,” and appears to have dropped its claim 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 Jan. 7, 2022 Order at 4, n. 2. ASIC has made no attempt to amend the Complaint to add 3 the contribution claim, despite being irrefutably on notice that no such claim had been made. 4 Moreover, any claim by ASIC for equitable contribution would fail. In Washington, “the 5 insurer who seeks contribution does not sit in the place of the insured and cannot tender a claim to 6 the other insurer. Thus, if the insured has not tendered a claim to an insurer prior to settlement or 7 the end of trial, other insurers cannot recover in equitable contribution against that insurer.” 8 Mut. of Enumclaw Ins. Co. v. USF Ins. Co., 164 Wn. 2d 411, 421 (2008) (emphasis added). It is 9 undisputed that BCS “was not asked by Premera to contribute to any of the settlements.” BCS 10 Mot. at 24. To the extent ASIC is attempting to make a late-stage claim for contribution, that 11 claim fails. 12 C. Whether ASIC Is Entitled to Subrogation Against BCS Related to the AG Settlement 13 ASIC contributed $2.7 million towards Premera’s $10 million settlement of the state AG 14 lawsuits, reduced to $2,305,350 after Lexington paid ASIC in settlement of this lawsuit. This 15 Court subsequently ruled on a motion for judgment on the pleadings, however, that the AG 16 settlements fell within an exclusionary clause in the ASIC policies that provided “[t]his insurance 17 does not apply to . . . Any obligation to pay fines and penalties.” Ex. E-1 to Compl., at 309 of 18 458; Ex. E-2 to Compl., at 356 of 458; see Jan. 7, 2022 Order. ASIC therefore now seeks 19 subrogation against BCS for the AG settlements payment, claiming that the BCS E&O policy did 20 provide coverage for the AG settlement. 21 Given this Court’s prior ruling, BCS cannot (and does not) deny that ASIC was not liable 22 under its policies for payment towards the AG settlements. BCS does deny, however, that it, BCS, 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 reimbursement; and (2) that the AG settlements payment is not covered under the BCS policy. 3 The Court addresses each argument in turn. 4 1. Whether it Would be Inequitable for ASIC to Subrogate Against BCS for AG Settlements Payment 5 BCS argues it would be inequitable for ASIC to shift any liability for the AG settlements 6 onto BCS, relying on three related arguments. First, BCS argues that it would be inequitable for 7 ASIC, whose liability attached at $5,000 under its primary CGL policy, and $2 million under its 8 umbrella policy, to subrogate against BCS, the secondary excess E&O carrier, whose liability 9 does not attach until $21.5 million, particularly when “ASIC’s coverage obligations to Premera 10 for the MDL settlement far exceeded the amount it reimbursed Premera.” BCS Mot. at 24.3 11 Second, BCS argues that subrogation against it would be inequitable because if 12 Washington’s “maximum loss rule” had been applied to apportion coverage in this case, ASIC 13 would have been liable for the full $17 million provided under its CGL and umbrella policies 14 (though in settlement, it has to date paid only approximately $14.3 million), and BCS would not 15 have been liable for anything.4 Under the maximum loss rule, an insured is reimbursed on a pro 16 rata basis from applicable policies sitting on the same layer of coverage; only after all limits are 17 exhausted on that layer does liability move on to the next layer. See Mission Ins. Co. v. Allendale 18 19 3 ASIC’s coverage obligation exceeded its reimbursement, according to BCS, because Premera settled the MDL lawsuit for $32 million, and ASIC contributed only $12 million towards that amount, in part because a number of 20 Premera’s other insurance carriers provided coverage. ASIC’s contribution to the MDL settlement was well short of the limits of its policies, collectively $17 million. BCS Mot. at 24. 21 4 ASIC disputes that the maximum loss rule can be applied to this case, given certain “other insurance” provisions in the various policies. The Court does not understand BCS as arguing, however, that the maximum loss rule should be applied in this case; merely that, had Premera’s insurers litigated the entire underlying data breach liability, a court 22 would have applied that rule; and that equity therefore now requires apportionment of liability in at least approximate conformity with this rule. The Court therefore does not determine whether the rule would or would not 23 apply. 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 totaled nearly $49 million; Premera held $57 million in coverage from its primary and first excess 3 policies alone. In other words, Premera could have been made whole without ever going above 4 the first excess layer of coverage, thus never reaching the BCS second excess policy. 5 Third and finally, BCS argues that “[i]t would be inequitable for ASIC, as an umbrella 6 carrier, to shift its coverage burden onto the BCS Second Excess Policy by allocating payments to 7 the State AG settlements when it was liable up to its limit for the MDL settlement.” BCS Mot. at 8 26. BCS imagines that by allocating to the AG settlements $2.7 million of the total $14.7 million 9 payment ASIC made to Premera—presumably knowing that Premera likely was not entitled to 10 coverage of those AG settlements under the ASIC policies—ASIC increased its chance of 11 obtaining subrogation against an insurer whose policies likely did provide such coverage. 12 According to BCS, rewarding this strategy by allowing subrogation “would encourage insurers to 13 voluntarily pay amounts of a loss it knows is uncovered in an effort to: (1) avoid responsibility for 14 other amounts which are covered and (2) seek recovery for the amounts it paid from other insurers 15 and reduce its liability to zero.” BCS Mot. at 26. 16 The Court rejects all of these arguments. Taking the third purported inequity first, the 17 Court handily rejects BCS’s strained argument that allowing ASIC to “shift” a portion of its total 18 payment to the AG settlements would create an incentive for an insurance carrier “to eliminate its 19 liability by only paying uncovered amounts and securing recovery from other insurers, despite 20 providing coverage for other portions of the loss.” Id. The idea that allowing ASIC to subrogate 21 against BCS for the AG settlements could create an incentive for an insurer to strategically cover 22 an uncovered loss in hopes of later recovery by subrogation, is both farfetched and unsupported 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 As to BCS’s “maximum loss rule” argument, the Court notes that this rule does not apply 3 to the facts of this case, as the insured settled the entirety of its claim with its insurers, 4 apportioned in ways, and for reasons, that are not in the record (or possibly, anywhere); and that 5 furthermore, BCS’s hypothetical scenario in which the maximum loss rule could have applied had 6 Premera not settled, depends on analyzing ASIC’s payment towards the MDL and AG settlements 7 as a lump sum, rather than as two separate payments, which they undisputedly were. Claiming an 8 inequity based upon inapplicable law and conjectural facts is simply not persuasive. 9 All three of BCS’s equity arguments amount essentially to the idea that it would be 10 inequitable for ASIC to be reimbursed for any amount it paid Premera, when ASIC’s liability 11 could have been worse. BCS has not supplied any supporting authority for this proposition; and 12 furthermore, the Court notes that it is BCS that has, to date, paid nothing towards its insured’s 13 losses, despite having issued a policy that follows form to the two carriers below it, which have 14 both contributed the entirety of their $10 million limit. Whether BCS is liable for the AG 15 payments, discussed infra, is a legal matter; but the Court finds that as an equitable matter, BCS is 16 not entitled to avoid any liability it might have in this case. Instead, the equities here align quite 17 easily with the law; if the ASIC policies provide coverage, ASIC should be liable for that 18 coverage. If, however, the ASIC policies do not provide coverage (as this Court has in fact 19 already determined with respect to the AG settlements), it is most equitable for any insurer whose 20 policies do provide coverage to pay its fair share. In other words, equity favors BCS reimbursing 21 ASIC for the amount ASIC paid to Premera toward the AG settlements, if the BCS policy 22 provides coverage therefor. 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 Separate and apart from its equity arguments, BCS also denies that its policy provides 3 coverage for the AG settlements. The relevant policy provision states, “[t]he Underwriter will pay 4 on behalf of the Insured any Loss which the Insured is legally obligated to pay as a result of any 5 Claim that is first made against the Insured.” Compl., Ex. F at 375. A “Loss” is defined as “any 6 monetary amount which an Insured is legally obligated to pay as a result of a Claim” related to 7 “maintaining the confidentiality of information regarding Medical Services or information 8 obtained in the provision of Managed Care Services and limiting the release or use of such 9 information in conformance with requirements of law.” Id. at 377. BCS does not deny that on its 10 face, the insuring clause would provide coverage for the AG settlements. 11 Instead, BCS argues that the loss here is excluded under a subsequent exclusionary clause, 12 which provides that a “Loss shall not include [] fines, penalties or taxes” and as BCS correctly 13 notes, this Court has already ruled that the AG settlements payment was for “fines and penalties.” 14 Id.; see Jan. 7, 2002 Order. The policy also goes on to say, however, that a “Loss shall include 15 fines and penalties imposed under [HIPAA] or any similar local, state or federal privacy statute or 16 regulation.” Id. (emphasis added). ASIC argues that because the AG settlements payment was in 17 fact “imposed under [HIPAA] or any similar local, state or federal privacy statute,” the fines and 18 penalties exclusion does not apply, and BCS is liable for the AG payments. 19 BCS attempts to evade the HIPAA exception to the fines and penalties exclusion by 20 claiming that “ASIC did not reimburse Premera for HIPAA fines or penalties, but rather fines and 21 penalties under state consumer protection statutes, which are not similar to HIPAA and thus do 22 not constitute covered Loss under the E&O policies.” BCS Mot. at 27-28. Based upon the Court’s 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 violations of HIPAA; the two states that did not include a HIPAA claim brought claims under a 3 “similar state privacy statute.” See generally Guite Decl., Ex. B; see also Florida Compl., id., at 4 262-71 (claiming violation of Florida Information Protection Act); Indiana Compl., id. at 373-84 5 (claiming violation of Indiana Disclosure of Security Breach Act). ASIC has thus met its burden 6 of demonstrating that the state AG claims—and therefore, Premera’s payment in settlement of 7 those claims—fell under the HIPAA exception to the “fines and penalties” exclusion, and were 8 covered under the BCS policy. That the states also made purportedly non-covered claims does not 9 alter this conclusion. As BCS itself observes, “[w]here a settlement resolves covered and 10 uncovered theories of liability that arise from the “same factual core,” allocation of the settlement 11 is not permitted.” BCS Mot. at 9 (citing Public Utility Dist. No. 1 of Klickitat County, 124 Wn. 2d 12 at 810; Nordstrom, 54 F.3d at 1430; In re Feature Realty Litig., 634 F. Supp. 2d 1163 (E.D. 13 Wash. 2007). 14 BCS attempts to muddy the conclusion that every state imposed “fines and penalties” 15 under HIPAA or a similar privacy statute, through a complex analysis of several of the state 16 settlements. It argues, for example, that only $850,000 of the $5.4 million Washington settlement 17 can possibly be attributed to HIPAA violations, and that therefore the remaining amount Premera 18 paid Washington must be based on the Washington CPA claims, which BCS argues is not 19 covered under its policy. BCS also engages in some qualitative reasoning, asserting that several 20 state AGs were “focused primarily on enforcement of state law requirements.” For example, BCS 21 argues, the “emphasis in the [Oregon] complaint and the settlement agreement are on non- 22 HIPAA, state-based consumer protection laws,” purportedly not covered under the BCS policy. 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 settlements with the State AGs were consumer protection statute driven, at least 51% of the 3 remaining State AG settlement payments should be allocated to non-HIPAA fines and penalties.” 4 The Court declines to engage in the type of speculative allocation BCS is proposing. Even 5 if Washington law authorized such allocation, which as a general matter it does not, BCS’s 6 calculations are based entirely on speculation, and are unreliable. ASIC paid Premera $2.7 million 7 of the total $10 million Premera paid in settlement of the AG lawsuits. Nothing in the record, 8 however, indicates in what way that $2.7 million should be allocated (e.g. only towards the 9 Washington settlement; or only towards claims of those states asserting a violation of a state 10 privacy statute); nor, with the apparent exception of the California settlement, do Premera’s 11 settlements with the states indicate towards which claims the settlement payments should be 12 allocated. Given this absence in the record of explicit allocation to covered and non-covered 13 claims, related either to the ASIC-Premera settlement or the Premera-AG settlements (again, other 14 than California), any post hoc allocation—no matter how expertly crafted—would be speculative, 15 most certainly inaccurate, and, therefore, impermissible under Washington law. In re Feature 16 Realty Litig., 634 F. Supp. 2d 1163, 1172 (E.D. Wash. 2007) (allocation of “judgment amongst 17 covered and non-covered theories of liability is impossible since no portion of [insured’s] 18 damages were uniquely attributable to the non-covered statutory claim.”); Providence Health & 19 Servs. v. Certain Underwriters at Lloyd's London, 440 F. Supp. 3d 1223, 1229 (W.D. Wash. 20 2020) (“Washington case law precludes allocation of damages to a non-covered claim where, as 21 here, the damages in question were recoverable both under a covered theory and an uncovered 22 theory.”). Because it is indisputable that BCS’s policy covers at least some (likely large) portion 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 fines and penalties, implicated in nearly all of the state AG complaints—BCS is liable for the 3 entire amount that ASIC is seeking. 4 D. ASIC’S Motion to Exclude 5 ASIC filed a Motion to Exclude the Report and Testimony of Iliana Peters. See Dkt. No. 6 121. BCS filed the purported expert opinion in support of its Motion for Summary Judgment. 7 ASIC’s motion is improvidently filed. See Local Rule 7(g) (“Requests to strike material contained 8 in or attached to submissions of opposing parties shall not be presented in a separate motion to 9 strike, but shall instead be included in the responsive brief.”). In addition, the Court did not rely 10 on the Peters opinion in its holding; the motion is therefore also moot. For these reasons, the 11 Court strikes ASIC’s Motion to Exclude. 12 IV. CONCLUSION 13 For the foregoing reasons, the Court grants in part and denies in part both parties’ Motions 14 for Summary Judgment. Specifically: 15 BCS has a duty to indemnify Premera, and therefore ASIC, for the $2,305,350 payment 16 that ASIC made towards Premera’s settlement of the state AG lawsuits; 17 ASIC is not entitled to subrogation against BCS for the approximate $12 million payment 18 ASIC made to Premera towards Premera’s settlement of the MDL lawsuit; the remaining claims 19 in ASIC’s Complaint are hereby dismissed; and 20 ASIC’s Motion to Exclude is stricken. 21 /// 22 /// 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25 2 A 3 B arbara Jacobs Rothstein U.S. District Court Judge 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 ORDER RE: CROSS MOTIONS FOR SUMMARY JUDGMENT 25