The U’s Data Breach

Insurer says it’s not liable for University of Utah’s $3.3M data breach

In lawsuit, Colorado Casualty says its policies do not obligate coverage

By Jaikumar Vijayan

June 4, 2010 08:12 PM ET

Computerworld – An Englewood, Colo., insurance company has filed a federal lawsuit contending that it isn’t reponsible for reimbursing the University of Utah for $3.3 million in costs related to a 2008 data breach caused by a third-party service provider.

The lawsuit filed in a Utah federal court by Colorado Casualty Insurance Co. contends that the insurer is not obligated to cover the costs sought by the university. Colorado Casualty was providing breach insurance to the univerity at the time of the breach.

The nine-page complaint, which seeks a declaratory judgment from the court, offers little explanation as to why exactly the insurer believes it is not obligated to pay the breach related costs sought by the university.

The breach occurred in June, 2008, when burglars stole back-up tapes containing sensitive data on 1.7 million patients at the University’s hospitals and clinics. The tapes were on their way to a storage facility when they were stolen from a car belonging to an employee at Perpetual Storage Inc. a Sandy-Utah-based data storage company used by the University.

The disks were recovered untouched a few days later, but the University ended up spending more than $3.3 million in breach notification costs, credit monitoring fees, phone bank costs and other expenses.

Steven McMurray, a lawyer representing Perpetual Storage, said that it’s not unusual for insurance companies to dispute claims involving potentially large payouts.

“We have filed a motion to dismiss the compliant,” he said.

The motion contends that that Colorado Casualty offered no obvious reasons for its objections, McMurray said. “We obviously think there is coverage,” he added.

Since the breach, Perpetual has changed to another insurance provider, he said.

Christopher Nelson, a spokesman at University of Utah Health Care and Health Science said the university would be “very disappointed” if a judge ruled in favor of Colorado Casualty’s complaint. In that case, the university will consider other avenues, which could include filing a lawsuit against Perpetual or its insurance agent, to recover the money.

Download Article

Tweet This Post