A "groundbreaking" appeal court decision confirming that an insurance company has a duty to defend a nurse facing a privacy breach lawsuit could have a major impact on a fast-developing area of litigation, Toronto employment lawyer Stephen Moreau tells AdvocateDaily.com.
Moreau, a partner with Cavalluzzo LLP, acts for a nurse who was sued by a patient over allegations that she inappropriately viewed the patient's private medical files. The patient also sued the hospital that employed the nurse at the time of the alleged breach.
The patient alleges the tort of intrusion upon seclusion, a category of privacy breach alleging one person looked into another’s affairs in an inappropriate way.
According to a story in the Simcoe Reformer, the nurse in the case was fired by her employer in 2013 after it alleged she had looked up the medical records of patients. The lawsuit was filed by a female patient at the hospital, who alleges her medical information was accessed by the nurse, even though the nurse was not involved in her care.
When the nurse turned to the hospital's insurance provider for coverage to defend the action, it initially refused, arguing that her conduct fell outside the scope of her employment duties, therefore was not covered by the policy.
Last summer, however, a Superior Court judge ruled the company did indeed have a duty to defend her.
“By covering breach of privacy in its policy, [the insurance company] was offering coverage for intrusion upon seclusion and was by definition, offering coverage for highly offensive conduct. This must by definition cover access to records by hospital employees outside of the circle of care,” the judge wrote.
The insurance company appealed. In its unanimous decision, a three-judge panel of the Ontario Court of Appeal upheld the lower court ruling.
“In our view this is precisely the sort of conduct the policy was intended to respond to. The applicant was employed by the hospital as a nurse and while on duty, in the course of the hospital’s operations, to use the language of the policy (which would include the maintenance of patient’s health records), she accessed the records that she had apparently no business doing because she was not involved in [the plaintiff’s] care,” the decision reads.
“In our view the common sense interpretation of the language can only have this meaning. To hold as the appellant argues that unauthorized access to medical records does not arise out of the hospital’s operations, or under the direction of the hospital because it would never direct such conduct, would negate the coverage intended. It is plain that the policy, in covering invasion of privacy, is intended to cover the type of conduct that is alleged in the Statement of Claim,” the appeal court judges added.
Moreau says he was not called to make oral submissions. However, the panel’s decision lined up with a factum he filed with the province’s top court in the case.
“This is a groundbreaking decision that could have major implications on insurance coverage, as claims of privacy breaches are increasingly being advanced,” Moreau says, pointing to the recent scandal involving Facebook data harvested and sold to a political consulting firm.
“If these insurance policies are as common as I believe they are, the decision will apply to many out there,” he adds.
Moreau explains that case law on the issue is lacking, in part, because Ontario’s privacy law is still developing. For instance, the tort of intrusion upon seclusion has a very short history, dating back to a landmark Court of Appeal decision in 2012 that recognized its existence for the first time in a case that involved a bank employee who repeatedly accessed the account records of a colleague after becoming romantically involved with the woman's ex-husband.