Transferring Cybersecurity Risk: Considerations When Obtaining Cyber Insurance

While procuring cyber insurance is an increasingly important business decision, choosing cyber insurance is not a simple process of merely identifying the amount of coverage desired and then paying for the corresponding premium.  Instead, as set forth below, it presents a matrix of considerations to be explored to ensure receipt of appropriate coverage when needed.

The Importance of Cyber Insurance

In the face of continued and more destructive cyber threats and the advent of more demanding statutory and regulatory requirements, it is critical for a company not only to mitigate risk through comprehensive cybersecurity management but also to transfer that risk by obtaining tailored cyber insurance.  Indeed, more rigorous regulations, along with their attendant financial penalties for noncompliance (such as the EU’s General Data Protection Regulation (“GDPR”), which became effective May 25, 2018, or the NY Department of Financial Services (“NYDFS”) cybersecurity regulation, which was instituted in 2017) are likely to become the norm, not the exception.  Violation of these more recent rules and requirements (and potential expenses and related fines) also do not apply only when data is lost through an actual breach, but also when data is destroyed or cannot be accessed (ransomware) and when data is improperly collected.  Moreover, cyber risks and costs are indiscriminate and affect all industries.

To offset these serious risks, cyber insurance usually is necessary.  Third-party cyber liability claims are not covered under most general liability policies including the Insurance Service Organization’s industry standard GL form.  Director & Officer liability policies usually exclude cyber liability claims.  Property policies, including the ISO “All Risk” form, typically exclude first party cyber claims.  Limited first party cyber coverage may be available through crime policies, and some Information Technology Industry Errors & Omissions policies afford third party cyber coverage.  In most cases, however, only a cyber policy can assure a company of the desired coverage.  A company has a much better chance for coverage and a prompt resolution of its claim under a cyber policy without the need to resort to litigation.

While cyber insurance has been available since the late 1990’s, it is rapidly expanding because of the continued need for a holistic approach to cybersecurity protection.  Indeed, insurance companies expect a surge of business as companies rush to purchase cyber insurance following the arrival of tougher regulations like the GDPR.

Cyber security and liability risks also often involve highly-technical, rapidly evolving information technology issues.  A prospective insured should inquire regarding the cyber experience of its broker, particularly if it is not using a large multi-line producer who has access to an IT consultant or cyber specialist.  Some brokers specialize in cyber insurance, and an insured should consider using a broker who possesses cyber experience.  While “bare bones” cyber coverage is available from authorized or “admitted” insurers, more comprehensive niche cyber coverage often is available only in the surplus lines or “non-admitted” market and can be brokered only by surplus lines producers.

The selection of an insurer is even more important.  In addition to issues of Best’s Financial Quality and Size Ratings, many insurers offer low cost, bares bones thirdparty coverage, while other insurers offer broader, albeit more expensive, coverage, and better claim service.

Cost-wise, premiums will be lower for those companies with comprehensive cyber-risk management plans in place with demonstrated levels of security and internal controls, i.e., better security equals lower risk, which equals more competitive pricing.  A company therefore is further incentivized to ensure it has adequate procedures in place to prevent, detect, investigate, and report data breaches.

The Level of Coverage Needed: Initial Considerations

One of the most important steps in the process of obtaining cyber insurance is to determine what type of coverage a company needs based on reasonably anticipated cyber risks inherent to a company’s business and position in the marketplace.  There are multiple considerations a company should undertake in assessing the kind and amount of coverage needed.

What type of company are you?

A company should consider:

>> its industry and the type of services it offers;

>> the type of data it handles (e.g., financial information, health information, credit information);

>> the makeup of its customers (e.g., whether they include EU citizens); and

>> what regulations it must follow.

Depending upon the kind of data it collects and handles, the company will be subject to a different array of regulations, which should inform the company regarding the type of cyber insurance coverage to be sought.  If a company is a financial institution, it must comply with the privacy rules of the Gramm Leach Bliley Act.  If the company handles personal health information, it will be subject to the privacy requirements of the Health Insurance Portability and Accountability Act, HIPAA.  If the company handles the data of EU citizens, it will be subject to the privacy restrictions (and severe potential penalties) of the GDPR.

First-Party and Third-Party Costs

The company also should think about the kinds of costs it may incur to manage a cyber incident/breach and whether cyber insurance coverage to defer or recoup all of those costs is necessary or prudent.  Such first-party costs can include:

>> forensic investigation costs to determine the source of the cyber incident/ breach and the extent of harm caused

>> remediation costs to rectify any network problem or software deficiencies

>> notification costs to customers whose data was compromised

>> data restoration costs of data stolen, lost, or altered

>> business interruption costs to help restore business functions and to maintain business capabilities while responding to a cyber incident

>> legal costs to evaluate regulatory obligations and assess any liability

>> public relation costs to help maintain and/or restore confidence in the company

Considering these first-party costs, however, is not as straightforward as it may seem.  For instance, assuming a company wants a policy to cover notification costs to advise its customers of a data breach, a company still needs to determine the type of notification it envisions.  Does it merely want to comply with statutory notification requirements or might it want to take a more aggressive approach to notification for customer relation purposes?  And how is the company going to notify its customers?  Email?  Regular mail?  First Class mail?  Similarly, when assessing remediation costs, the company also needs to determine if it wants to provide credit monitoring to its customers and have those costs covered under a cyber policy.  A company must think through these issues to help ensure the right cyber insurance coverage is obtained.

Furthermore, a company may also incur third-party costs as a result of a cyber-event, such as defending against a litigation or regulatory action.  Contemplating cyber coverage for these types of third-party costs also compels additional considerations regarding the extent of coverage desired.  For example, legal fees in defending a claim often can approach or even exceed the ultimate cost of settling the claim.  A company should decide if it wants its litigation costs to erode the policy’s limit of liability, sometimes referred to as being “cost-inclusive,” or whether defense costs should be in addition to the limit of liability.  With regard to a regulatory inquiry, while payment of fines and penalties is unlawful in some jurisdictions and is often excluded from coverage, the company must determine if it wants coverage to include investigatory costs in responding to the governmental inquiry.  Some policies cover up to half of the investigatory costs of responding to a governmental inquiry or subpoena, usually subject to a sublimit on liability.

Do the Provisions of the Policy Ensure the Desired Coverage?

Once a company identifies the coverage it hopes to purchase, it then is essential to carefully consider the specific provisions of a cyber policy to ensure receipt of the level of coverage sought for the cyber risk possibilities reasonably envisioned.  Among the questions when analyzing the policy’s provisions are:

>> When is coverage triggered?

>— Is the policy written on an “occurrence” basis, i.e., the breach must occur during the policy period to be covered, or is it written on a claimsmade basis, i.e., the claim must be made and reported during the policy period in order for coverage to be available?

>— If the policy is written on a claims-made basis, does the breach nevertheless have to occur during the policy period, does it merely have to be discovered in the policy period, or both?

— Is intentional conduct required (by a third-party or malicious company insider) or can coverage be triggered by the negligence of an employee?

>— Is the conduct of a malicious insider to the company covered or must the cyber incident be caused by an outside third-party?

>— Must data have been disseminated outside the company (a breach) or will the policy also cover situations where data is destroyed or cannot be accessed (e.g., ransomware)?

>> What kind of information is covered?

>— How is “personal information” defined?

>— Is “confidential corporate information” covered?

>> Does the policy require minimum security requirements be maintained to protect the company’s computer network and data?

>> What devices are covered?

>— Are only the company’s servers and computers covered?

>— How are mobile devices (laptops, mobile phone, thumb drives) treated?

>— If the company allows employees to use personal devices or work remotely (BYOD – Bring Your Own Device policies), are cyber incidents originating on an employee’s personal device covered?

>> Are cyber breaches or incidents caused by vendors assisting the company (e.g., HVAC, data processors, cloud providers) covered?

>— Would coverage only extend to breaches caused by a vendor on the company’s network?

>— Would coverage extend to a breach of a vendor’s network housing the company’s data?

>> What are the policy provisions regarding notice and defense of a claim?

>— How quickly does the policy require a claim to be reported to the carrier?

>— Whose knowledge of a breach is imputed to the company for the purpose of determining whether a claim has been reported late and whether an exclusion applies?

>— Does the definition of “claim” include responding to a subpoena?

— Is the defense obligation of the policy a “duty to defend” where the insurer controls the defense and settlement of a claim or does the policy have a duty to advance defense costs, which permits the policyholder to control the defense and settlement of the claim at the cost of the insurer?

>— If the policy has a duty to advance costs, are there limitations on who the company can retain as outside counsel or as a forensic expert?

>— Are regulatory investigations covered?

>— Does the policy cover investigatory costs in responding to a governmental inquiry?

>— Are fines covered?  If so, is the company domiciled in a jurisdiction where indemnification against fines and penalties is not against public policy?

>— How is regulator defined?  Does it cover EU regulators?

To be sure, disputes between policyholders and insurance carriers are inevitable, and insurers will attempt to strictly construe policies against coverage.  Courts are just beginning to interpret cyber insurance policy provisions, sometimes coming out on opposite sides of the same issue depending upon the jurisdiction.

For instance, courts have disagreed whether cyber insurance policies cover losses resulting from social engineering, i.e., when a company employee is falsely manipulated to wire out company funds based on what is believed to be a legitimate email authorizing the transfer but what is actually an email initiated by a fraudster.  Insurers may assert that a loss caused by social engineering (also known as business email compromise) is not a direct loss under the computer fraud provisions of a cyber insurance policy.  Carriers attempt to distinguish between fraudulently causing a transfer (via social engineering) and causing a fraudulent transfer (via hacking into a company’s computer network to wire out funds).

Insurers also have sought to disclaim coverage by invoking exclusions for a company’s failure to maintain agreed-upon levels of cybersecurity to protect the company’s network and data.  Courts have been asked to construe cyber policy provisions to determine whether the insured satisfied the policy’s security requirements.  Considering that industry cybersecurity measures are constantly updated, a company should attempt to avoid a situation where a court’s interpretation of policy language and evaluation of a company’s cybersecurity efforts will determine whether it can recoup losses from a cyber event.

Conclusion

As criminals find new and more inventive ways to attack computer systems or fraudulently cause the theft of company funds, a company faces the increased risk of loss, which can result from a combination of illegal activity, imperfect network security, and employee negligence.  As such, a company should undertake a complete strategy to combat cybersecurity-related threats, which includes procuring appropriate insurance coverage to manage reasonably anticipated cyber risks.  Carriers may attempt to dispute claims, so a company must give special attention to cyber policy language to avoid the possibility of coverage being denied.  To help negotiate policy provisions to avoid ambiguities and potential grounds for disputes, a company should explore using an insurance professional to help negotiate a policy with the desired coverage, including identifying additional policy endorsements that may be available to cover certain specific cyber threats.  When procuring cyber insurance, considering the questions and issues outlined above may make the difference between receiving expected cyber coverage and not.

 

© Copyright 2018 Sills Cummis & Gross P.C.
This post was written by Joseph B. Shumofsky and Thomas S. Novak from Sills Cummis & Gross P.C.

Massachusetts to Require CGL and PL Coverage for All “Marijuana Establishments”

In regulations finalized just before the March 15, 2018, deadline, the Massachusetts Cannabis Control Commission (CCC) has included a provision requiring the maintenance of liability insurance or an escrow account to cover potential liabilities. This applies to all Marijuana Establishments, which include marijuana cultivators, craft marijuana cooperatives, marijuana product manufacturers, marijuana retailers, independent testing laboratories, marijuana research facilities, marijuana transporters and “any other type of licensed marijuana-related businesses,” except for medical marijuana treatment centers, which are already subject to a comprehensive regulation scheme, including a similar requirement.

Provisions

Under the new regulations, Marijuana Establishments must obtain and maintain general liability coverage with minimum limits of at least $1 million per occurrence and $2 million aggregate, and product liability insurance coverage of $1 million per occurrence and $2 million aggregate, with a maximum deductible of $5,000 per occurrence. 935 CMR 500.105(10)(a).

In the event that a Marijuana Establishment is unable to obtain the required coverage, upon providing documentation of the unavailability of coverage, the requirement may be met by the deposit of $250,000, or some other amount approved by the CCC, into an escrow account. 935 CMR 500.105(10)(b).

Any new applicant will be required to provide a description of its plan to obtain the required insurance coverage or otherwise meet the requirements of this regulation as part of the application process. 935 CMR 101(c)(5).

This insurance requirement is one of several designed to ensure the financial responsibility of marijuana businesses in the Commonwealth, including a requirement that applicants detail the amounts and sources of capital resources available to them, and a requirement that a license applicant provide documentation of a bond or other resources held in an escrow account in an amount sufficient to adequately support the dismantling and winding down of a Marijuana Establishment pursuant to 935 CMR 500.101(1)(a).

Synopsis

The recreational marijuana business regulations were approved on March 9, 2018, after extensive hearings and public input. The regulations must be signed by the Secretary of the Commonwealth and published in the Massachusetts Register, which is expected to take place on March 23, 2018. The regulations become effective upon publication.

Massachusetts voters approved the legalization of recreational marijuana via ballot in November 2016. The CCC plans to begin accepting applications on April 1, 2018, and recreational marijuana sales are expected to begin on July 1, 2018. Existing medical marijuana treatment centers have been given priority for licensure in towns and cities where the number of licenses is limited, see MGL c. 94G, § 5(c), and already will have these coverages in place. However, as applications will be reviewed on a rolling basis, we would expect to see the number of businesses seeking this coverage only increasing.

 

© 2018 Wilson Elser
This post was written by Kara Thorvaldsen of Wilson Elser.

Confusion Amongst Texas Courts: When Can Insureds Recover Policy Benefits for Statutory Violations?

While first-party bad faith claims may appear to be a dying notion in other jurisdictions, the tort-based claim in Texas is alive and well. Throughout the years, courts have continued to search for ways to define the common-law standard and balance it with public interest due to the unequal bargaining power in the insured-insurer relationship.For this reason, the law of bad faith in Texas is constantly evolving.

Texas imposes a common law duty on insurers to “deal fairly and in good faith with their insureds.”A breach of the duty of good faith and fair dealing gives rise to a tort cause of action that is separate from any action for breach of the underlying insurance policy.If an insurer breaches its duty of good faith and fair dealing, in addition to interest, court costs and attorney’s fees, the insured can recover actual, i.e. extra-contractual, damages for economic or personal injuries and exemplary damages if: (1) actual damages were awarded for an injury independent of the loss of policy benefits and (2) the insurer’s conduct was fraudulent, malicious, intentional or grossly negligent.Exemplary damages are within the jury’s discretion and “must be reasonably proportioned to actual damages.”5

Texas also provides a statutory scheme for bad-faith claims that allows recovery of extra-contractual damages through a private cause of action against an insurer. The statutory bad-faith tort is governed by Chapter 541 of the Texas Insurance Code (“Code”).The statutory claim is in addition, and a supplement, to the contractual cause of action against an insurer for breach of an insurance policy. Similar to the common law claim, for Code violations the insured may recover economic damages, but only up to three times the amount of economic damages, i.e. treble damages, for violations committed “knowingly.”7

It is not uncommon in first party bad-faith cases for the insured to assert a breach of contract claim against the insurer for breaching the insurance policy and a tort cause of action against the insurer for violations of the Code. However, extra-contractual tort claims brought pursuant to the Code require the same predicate for recovery as a bad faith claim under a good faith and fair dealing violation.Because the frameworks of the statutory and common law claims are so similar, most Texas courts have treated common law claims as redundant.

When considering the damages available under the policy and under the statute, there have been some inconsistencies amongst Texas courts regarding the recovery of policy benefits when there have been statutory violations of the Code. As such, in USAA Texas Lloyds Company v. Gail Menchaca, the Texas Supreme Court seized the opportunity clear up the confusion by addressing the issue of whether an insured can recover policy benefits for Code violations when there has been no breach of the insurance policy.9

USAA v Menchacha

In Menchaca, the Texas Supreme Court acknowledges, “When our decisions create such uncertainties, ‘it is our duty to settle conflicts in order that the confusion will as nearly as possible be set at rest.’”10 Thus, the goal in Menchaca was “to provide clarity regarding the relationship between claims for an insurance policy breach and Insurance Code violations.”11 The primary question was “whether an insured can recover policy benefits as actual damages caused by an insurer’s statutory violation absent a finding that the insured had a contractual right to the benefits under the insurance policy.”12

Following Hurricane Ike in September 2008, Gail Menchaca contacted her homeowner’s insurance company, USAA Texas Lloyds (“USAA”), and reported storm damage to her home.13 The USAA adjuster who inspected Menchaca’s claim found only minimal damage.14 USAA determined that the damage was covered under Menchaca’s policy but declined to pay benefits because the total repair costs did not exceed the deductible under Menchaca’s policy.15 Five months later, at Menchaca’s request, another USAA adjuster re-inspected Menchaca’s home.16 The second adjuster confirmed the first adjuster’s findings and again USAA declined to pay any policy benefits.17 Menchaca filed suit against USAA for breach of the insurance policy and for unfair settlement practices in violation of the Texas Insurance Code. Menchaca sought policy benefits for both claims.18 For the alleged breach of the insurance policy, she sought benefit of the bargain damages, i.e. the amount of her claim for policy benefits and attorney’s fees. For the statutory violations, she sought actual damages, i.e. the loss of the benefits that should have been paid pursuant to the policy, court courts and attorney’s fees.19

The case proceeded to a jury trial and three questions were submitted to the jury.20 Question 1 addressed Menchaca’s breach of contract claim and asked whether USAA failed “to comply with the terms of the insurance policy with respect to the claim for damages filed by Gail Menchaca resulting from Hurricane Ike” and the jury answered “No.” Question 2 addressed Menchaca’s claim for statutory violations and asked “whether USAA engaged in various unfair or deceptive practices, including whether USAA refused to “pay a claim without conducting a reasonable investigation with respect to that claim” and the jury answered “Yes.” Question 3 asked the jury to determine Menchaca’s damages that resulted from either USAA’s failure to comply with the policy or its statutory violations, calculated as “the difference, if any, between the amount USAA should have paid Gail Menchaca for her Hurricane Ike damages and the amount that was actually paid” and the jury answered “$11,350.”21

Both parties moved for judgment in their favor. USAA argued that Menchaca was not entitled to recover for bad faith or extra-contractual liability because the jury found that it did not breach the insurance policy. Menchaca argued that the jury answered Questions 2 and 3 in her favor and neither were dependent on a favorable answer to Question 1. The trial court disregarded Question 1 and entered judgment in Menchaca’s favor. The court of appeals affirmed and the Texas Supreme Court granted USAA’s petition for review.22

In analyzing whether an insured can recover policy benefits as actual damages caused by an insurer’s statutory violation absent a finding that the insured had a contractual right to benefits under the insurance policy, the Court set forth “five distinct but interrelated rules that govern the relationship between contractual and extra-contractual claims in the insurance context.”23 Following the Court’s analysis of these rules, it determined that the court of appeals erred by affirming the trial court’s decision to disregard the jury’s answer to Question 1. The Court further stated, “In light of the parties’ obvious and understandable confusion over our relevant precedent and the effect of that confusion on their arguments in this case, we conclude that a remand is necessary here in the interest of justice.”24 The rules outlined by the Court are as follows:

Rule 1:

General Rule: An insured cannot recover policy benefits for an insurer’s statutory violation if the insured does not have a right to those benefits under the policy.25 This rule is derived from the Court’s rule in that “there can be no claim for bad faith when an insurer has promptly denied a claim that is in fact not covered.”26 Although the fact pattern in Stoker was limited to the bad faith denial of a claim, the Court has since applied the general rule to other types of extra-contractual violations, i.e. failing to properly pay a claim, failing to fairly investigate a claim and failing to effectuate a prompt and fair settlement of the claim.27 The general rule is derived from the fact that Code “only allows an insured to recover actual damages ‘caused by’ the insurer’s statutory violation.”28 In determining whether the insured has to establish a right to benefits and then a breach of the policy to recover policy benefits for statutory violations, the Court stated, “While an insured cannot recover policy benefits for a statutory violation unless the jury finds that the insured had a right to the benefits under the policy, the insured does not also have to establish that the insurer breached the policy by refusing to pay those benefits.”29

Rule 2:

Entitled to Benefits Rule: An insured who establishes a right to receive benefits under an insurance policy can recover policy benefits as “actual damages” under the statute if the insurer’s statutory violation causes the loss of the benefits.30 “If an insurer’s ‘wrongful’ denial of a ‘valid’ claim results from or constitutes a statutory violation, the resulting damages will necessarily include ‘at least the amount of the policy benefits wrongfully withheld.’”31

Rule 3:

Benefits Loss Rule: An insured can recover policy benefits as actual damages under the Insurance Code even if the insured has no right to those benefits under the policy, if the insurer’s conduct caused the insured to lose that contractual right. 32 The Court has recognized this principle in cases alleging claims against an insurer for misrepresenting a policy’s coverage, statutory violations by the insurer which prejudice the insured by waiving its right to deny coverage or is estopped from doing so, and statutory violations that cause the insured to lose a contractual right to benefits that it otherwise would have been entitled to.33 “[A]n insurer that commits a statutory violation that eliminates or reduces its contractual obligations cannot then avail itself of the general rule.”34

Rule 4:

Independent Injury Rule: The first aspect of the rule is that if an insurer’s statutory violation causes an injury independent of the insured’s right to recover policy benefits, the insured may recover damages for that injury even if the policy does not entitle the insured to receive benefits.35 This rule takes into account that there may be some extra-contractual claims that may not “relate to the insurer’s breach of contractual duties to pay covered claims” and recognizes that there may be compensatory damages different from policy benefits that result from the tort of bad faith under common law.36

The second aspect of the independent-injury rule is that an insurer’s violation does not allow the insured to recover any damages beyond policy benefits unless the violation causes an injury that is independent from the loss of the benefits.37 For instance, the Court held in Twin City Fire Ins. Co. v. Davis that “an insured who prevails on a statutory claim cannot recover punitive damages for bad-faith conduct in the absence of independent actual damages arising from that conduct.38 Notably, as it relates to the independent-injury rule, the Court states that an independent-injury claim would be rare, they have yet to encounter one, and “have no occasion to speculate what would constitute a recoverable independent injury.”39

Rule 5:

No-Recovery Rule: An insured cannot recover any damages based on an insurer’s statutory violation unless the insured establishes a right to receive benefits under the policy or an injury independent of a right to benefits.40.

Conclusion

“It is the beginning of wisdom when you recognize that the best you can do is choose which rules you want to live by, and it’s persistent and aggravated imbecility to pretend you can live without any.”41 The Texas Supreme Court has attempted to clear up the confusion caused by its precedent by adopting five rules on the issue of recovery of policy benefits for statutory violations. While the rules appear fairly simplistic and undoubtedly will provide guidance, it remains to be seen whether the opinion actually brings clarity to the situation or simply a lesser degree of confusion for the courts to follow. In any event, the rules in Menchaca appear to weigh in favor of insurers because the law is settled, i.e. there must be a right to receive benefits or a (rare, but possible) independent injury to receive policy benefits for statutory violations.


[1] Universal Life Ins. Co. v. Giles, 950 S.W.2d 48, 53 (Tex. 1997).

[2] Arnold v. Nat’l Cty. Mut. Fire Ins. Co., 725 S.W.2d 165, 167 (Tex. 1987).

[3]Viles v. Sec. Nat’l Ins. Co., 788 S.W.2d 566, 567 (Tex. 1990).

[4] Pena v. State Farm Lloyds, 980 S.W.2d 949, 958 (Tex. App.—Corpus Christi 1998, no pet.); Giles, 950 S.W.2d at 54. See also Arnold, 757 S.W.2d at 168 (stating, “[E]xemplary damages and mental anguish damages are recoverable for a breach of the duty of good faith and fair dealing under the same principles allowing recovery of those damages in other tort actions.”).

[5] Pa Preston Carter Co. v. Tatum, 708 S.W.2d 23, 25 (Tex. App.—Dallas 1985, no writ). There is no set rule or ratio between the amount of actual damages and exemplary damages which will be considered reasonable and the determination is made on a case-by-case basis. Alamo Nat’l Bank v. Kraus, 616 S.W.2d 908, 910 (Tex. 1981).

[6] Texas does not adhere to the Uniform Deceptive Trade Practices Act adopted by many other states, but has its own set of laws, known as the Texas Deceptive Trade Practices Act (“DTPA”). Chapter 541 of the Texas Insurance Code addresses the protection of consumer interests against deceptive, unfair, and prohibited practices within the context of insurance. Chapter 17.50(a)(4) of the DTPA incorporates Chapter 541 of the Texas Insurance Code in its entirety.

[7] TEX. INS. CODE § 541.152

[8] National Sec. Fire & Cas. Co. v. Hurst, 523 S.W.3d 840, 840 (Tex. App.—Houston 14th Dist. 2017, no pet.).

[9] No. 14-0721, 2017 WL 1311752, at *1 (Tex. 2017).

[10] 2017 WL 1311752, at *1.

[11] Id. at *3.

[12[ Id. at *1.

[13] Id. 

[14] Id. 

[15] Id. 

[16] Id. 

[17] Id. 

[18] Id. 

[19] Id. at *3.

[20] Id. at *2.

[21] Id.

[22] Id.

[23] Id. at *4.

[24] Id. at *14

[25] TEX. INS. CODE § 541.151; Stoker, 903 S.W.2d at 341.

[26] Republic Ins. Co. v. Stoker, 903 S.W.2d 338, 341 (Tex. 1995).

[27] Menchaca, 2017 WL 1311752, at *5.

[28] Id. (citing TEX. INS. CODE § 541.151).

[29] Menchaca, 2017 WL 1311752, at *7.

[30] Id

[31] Id. (citing Vail v. Texas Farm Bureau Mut. Ins. Co. v. Castaneda, 988 S.W.2d 189, 188 (Tex. 1998).

[32] Menchaca, 2017 WL 1311752, at *10 (emphasis in original).

[33] Id.

[34] Id.

[35] Id. at *11.

[36] Id.. ; see also Twin City Fire Ins. Co. v. Davis, 904 S.W.2d 663, 666 (Tex. 1995) (identifying mental anguish damages as an example).

[37] Menchaca, 2017 WL 1311752, at *11 (emphasis added).

[38] 904 S.W.2d 663, 666 (Tex. 1995) (citing Federal Express Corp. v. Dutschmann, 846 S.W.2d 282, 284 (Tex. 1993) (stating that “[r]ecovery of punitive damages requires a finding of an independent tort with accompanying actual damages.”). Therefore, insurers are not liable for punitive damages if there is not an independent injury resulting in extra-contractual damages.

[39] Menchaca, 2017 WL 1311752, at *12.

[40].Menchaca, 2017 WL 1311752, at *12; Casteneda, 988 S.W.2d at 198.

[41] WALLACE STEGNER, ALL THE LITTLE LIVE THINGS (PENGUIN BOOKS 1991).

 

© Steptoe & Johnson PLLC. All Rights Reserved.
This post was written by Dawn S. Holiday of Steptoe & Johnson PLLC.

Insurance Coverage in the Post-Weinstein Era

With new headlines involving sexual harassment and other inappropriate sexual conduct continuing to emerge on a daily basis, insurance coverage for claims that might emerge is something every company should consider.

Recently, media reports have discussed settlements of shareholder derivative claims against members of the boards of directors and other senior executives of public companies. These settlements illustrate both the type of corporate liability that can ensue from allegations that a company turned a blind eye to, or otherwise failed to prevent, sexual misconduct allegations, causing financial and reputational harm to the organization, and the critical role insurance can play in protecting companies and their executives against such claims.While reports indicate that one or more of the settlements is being funded entirely from insurance proceeds, it is unclear whether the settlement proceeds will be coming from D&O insurance or EPLI insurance, or both. D&O insurance is intended to cover corporate mismanagement claims but typically contains some form of employment practices liability exclusion. EPL insurance is intended to cover employment practices liability claims but may not cover management liability claims arising from allegations of sexual harassment. This creates a potential gap in coverage that could have serious consequences.

D&O and EPLI policies are not standard and contain different wording and exclusions.

WHAT TO DO?

In this environment, it behooves corporate management of every company to understand the scope of insurance coverage for sexual harassment and management liability claims and to ensure that appropriate coverage is in place without coverage gaps.

Here is what policyholders should do: comprehensively review all relevant corporate insurance programs to determine what coverage is in place for sexual harassment claims of any variety, and for claims arising from corporate actions that might be necessary in the wake of an issue or claim, such as claims of wrongful termination and defamation.

Policies to be reviewed should include CGL, EPL, D&O and E&O.

Determine whether coverage gaps exist and if so, consider enhancing coverage to ensure proper protection.

Understand what needs to happen in terms of notice to insurers in the event of a claim or knowledge of circumstances that might lead to assertion of a claim.

And be aware of the potential for coverage before agreeing to any payments or settlements that might preclude or limit coverage.

© 2017 Proskauer Rose LLP.
This post was written by Seth B Schafler of Proskauer Rose LLP.
Learn more at the Insurance Law Page on the National Law Review.

Effects of Insurance Marketplace Uncertainty

Even as Senators continue to consider “Graham-Cassidy,” the latest Affordable Care Act (ACA) repeal legislation, insurance markets are already reacting to uncertainty and instability brought about by persistent GOP efforts to upend the post-ACA insurance landscape. Between the Trump Administration’s ongoing refusal to commit to long-term funding of the ACA’s cost-sharing reductions (CSRs) and legislative overtures to repeal key portions of the ACA, premiums have increased, insurers have exited state exchanges, and access to health care coverage has been compromised.

As the Congressional Budget Office (CBO) recently estimated, insurers are expected to “raise premiums for marketplace plans in 2018 by an average of roughly 15 percent, largely because of uncertainty about whether the federal government will continue to fund CSR payments and because of an increase in the percentage of the population living in areas with only one insurer.” Speaking to the latter factor, CBO notes that a number of insurers have withdrawn from healthcare exchanges established under the ACA, spurred, at least in part, by “uncertainty about the enforcement of the individual mandate, and uncertainty about the federal government’s future payments for [CSRs].” Although ACA proponents’ (and critics’) most dire predictions were narrowly avoided – that some counties would have no insurers offering marketplace plans – there is little doubt that insurer participation has been adversely impacted by market uncertainty, with pocketbook repercussions for policy-holders.

The turbulent political climate is also likely to reduce the number of insured individuals in 2018. CBO and the Joint Committee on Taxation anticipate lower insurance enrollment as a result of reductions in federal-sponsored advertising and outreach. Department of Health and Human Services officials recently indicated that the advertising budget for the open enrollment period commencing in November would be reduced to $10 million, amounting to a 90% reduction when compared to spending in the last year of the Obama Administration. Grants to “navigators” – nonprofit groups that assist people with marketplace insurance plan enrollment – will be reduced from approximately $63 million to $36 million.

Whether or not the worst is yet to come will hinge on the fate of Graham-Cassidy and the presently-stalled efforts to reach consensus on a bipartisan ACA stabilization bill. In what is turning out to be a recurring theme in 2017, we may have to wait several weeks for the dust to settle and reasoned prognostication to be possible.

This post was written by Matthew J. Goldman & Jordan E. Grushkin of Sheppard Mullin Richter & Hampton LLP., Copyright © 2017
For more legal analysis go to The National Law Review 

Litigation After Devastation: The Legal Storm Surge

Bridges crumbling in Texas. Houses turned to toothpicks in the USVIs. Newly-formed rivers ravaging the streets in South Florida. The devastating destruction from the recent hurricanes that have pummeled the U.S. has uprooted many peoples’ homes and lives, but we have only begun to feel the impact of the surge.

Massive relief efforts have begun, national fundraising, news coverage, responsive legislation, and building codes to name a few. A litigation surge is swelling as well. We have seen several types of cases and class actions churn from a hurricane’s aftermath. Here are some of the types of cases, coverage issues, and expert needs you may see after the storm.

Property Damage and Meteorological Causation

Insurance companies insuring the Southern United States are bracing for the waves of claims that will soon be flooding in. Just as it was following Hurricanes Katrina, Ivan, and Sandy, the hotly-debated issue of whether the damage was caused by wind or water will be the likely focus. While most homeowner insurance policies will cover water damage that was caused by a roof or window that was compromised by wind and allowed water intrusion, most do not cover water that rises from the ground level and enters the home. Experts will be relied upon to determine how water got into a structure, even when it is entirely obliterated.

Insurance companies and attorneys will be looking for experts in meteorology, often with advanced degrees and testifying experience, who can opine on the types of weather conditions that might have existed at a given time in a given place (i.e., Key West when Hurricane Irma struck). The experts could come from academia or environmental institutes and societies. They will be asked to review various data points and speak on weather conditions at a particular time and place to support causation for insurance coverage. Structural engineers will also be needed, preferably with experience in standard insurance practices, procedures, and protocols in evaluating damage caused by hurricanes. They will need to have an understanding of insurance claims handling and will be asked to review various reports and data, some from other engineers, discussing damage caused to structures by the hurricane and opine as to whether or not the reports and data are accurate.

Structural Failures and Faulty Design/Construction

While many large, concrete commercial buildings and bridges are designed to withstand 150+ mph winds and flooding,  they can still be left severely damaged after a storm blows through. Structural failure of buildings, roofs, bridges, and roadways that were expected to withstand hurricane winds will lead to litigation over damage caused by the failure. Structural engineers with expertise in the types of structures at issue, likely licensed engineers, will be needed to examine damage patterns through photos, video, or via a post-storm on-scene inspection. They will also need to use meteorological wind information to determine the cause of the failure and the quality of the design or construction.

Class Actions for Coverage Determinations

Often, the core issues in insurance-related storm damage cases are similar across a wide span of policyholders. These cases will vary depending on the coverage matter at issue, but the most sought-after experts will be familiar with insurance claims standards, protocols, and policy interpretation. Construction experts may also be needed to opine on the necessity and extent of certain repairs required after a storm. Also, standard practices and interactions between contractors and insurance companies during the re-build process will come into question. Class actions may be filed as well, simply as placeholders to toll certain claims-filing deadlines or allow broader bad faith discovery against insurance companies who refuse to pay mass claims.

Litigation Over Price-Gouging

One of the worst scenarios to follow a storm is wide-scale price-gouging and scamming by companies trying to capitalize on the desperation and vulnerability of storm victims. Before the storm, many people preparing for power outages or evacuation will see unfair spikes in essentials such as water and gas. After the storm, shady contractors and tree-removers often flood in, lie about their licensing and credentials, and charge exorbitant fees while performing shoddy, haphazard work, or no work at all. Many states, including Florida, have made it a crime for any service provider to offer or sell essential commodities for an amount that “grossly exceeds the average price” during the thirty days following a declaration of emergency. In the days before Hurricane Irma’s approach, many reported price-gouging for essentials such as water, ice, batteries, and gas when thousands of Floridians were stocking up or evacuating. Class actions alleging price-gouging will likely occur following the storm. Experts in standard industry pricing, manufacture costs, and storm clean-up and repair may be called in to opine on the “average price” of certain essential commodities and post-storm services.

In the wake of Hurricanes Harvey and Irma, we are gearing up for the incumbent waves of litigation and expert requests we anticipate will follow. What types of cases, class actions, and expert needs are you expecting?

This post was written by Annie Dike of IMS ExpertServices, All Rights Reserved. © Copyright 2002-2017
For more legal analysis go to The National Law Review

Hurricanes and Act of God Defenses

Maritime contracts for services generally include clauses for performance, demurrage, deviation, termination, and suspension. Performance may be affected by an Act of God or Force Majeure clause and event. A typical Force Majeure clause reads as follows:

Except for the duty to make payments hereunder when due, and the indemnification provisions under this Agreement, neither Company nor Contractor shall be responsible to the other for any delay, damage or failure caused by or occasioned by a Force Majeure Event as used in this Agreement. “Force Majeure Event” includes: acts of God, action of the elements, warlike action, insurrection, revolution or civil strife, piracy, civil war or hostile action, strikes, differences with workers, acts of public enemies, federal or state laws, rules and regulations of any governmental authorities having jurisdiction in the premises or of any other group, organization or informal association (whether or not formally recognized as a government); inability to procure material, equipment or necessary labor in the open market acute and unusual labor or material or equipment shortages, or any other causes (except financial) beyond the control of either Party. Delays due to the above causes, or any of them, shall not be deemed to be a breach of or failure to perform under this Agreement.

A. Act of God

Act of God or Force Majeure is a defense to many contractual obligations, including performance, deviation, and demurrage. It may also be the basis to suspend or terminate a maritime agreement for cause. It is defined as an abnormal natural event that is overwhelming and cannot be forestalled nor controlled. Skandia Ins. Co., Ltd. V. Star Shipping, AS, 173 F.Supp. 2d 1228 (S.D. Ala. 2001) (Hurricane Georges cargo claim). It is also a defense to certain tort claims like collisions and allisions occurring during a storm. Petition of U.S., Heide Shipping & Trading v. S.S. Joseph Lykes, 425 F.2d 991 (5th Cir. 1970) (vessel break-away in Hurricane Betsy).

When plead, a party must demonstrate that it was prudent in predicting and attempting to avoid the impact of the overwhelming and unexpected natural event and took reasonable precautions under the circumstances. A failure to perform or third party tort damages are not subject to an Act of God defense if the failure results from human agency, neglect or an unseaworthy condition. Compania DeVapores Ins. Co., SA v. Mo-Pac R.R. Co., 232 F.2d 657 (5th Cir. 1985) (cargo claim for failure to take reasonable steps to guard against wind storm).

Following Hurricane Katrina, the U.S. District Court for the Eastern District of Louisiana held that a category 4 or 5 hurricane was an Act of God sufficient to bar a tort claim by a marina owner against the owner of a vessel that broke away from her berth, drifted and hit another vessel. The defense of Act of God applied because, 1) the accident was due exclusively to abnormal natural events without human interest, and (2) there was no intervening negligent behavior by the vessel owner. J.W. Stone Oil Dist., LLC v. Bollinger Shipyard, 2007 WL 2710809 (E.D. La. 2007). Judge Lemmon held in Stone Oil that hurricanes are considered as a matter of law to be an Act of God and defensible unless there is an intervening and contributing act of individual negligence. This obligation includes taking reasonable precautions based upon all available information.

In Simmons v. Lexington Ins. Co., 2010 WL 1254638 (E.D. La. 2010), aff’d., 401 Fed. Appx. 903 (5th Cir. 2010), J),  the courts similarly considered whether reasonable precautions had been taken by a marina to protect a sailboat during Hurricane Katrina under both Louisiana and maritime law. The Court reviewed other Katrina cases, including Conagra Trade Group, Inc. v. AEP Memco, LLC, 2009 WL 2023174 (E.D. La. 2009), and Coex Coffee Int’l., Inc. v. Dupuy Storage & Forwarding, LLC, 2008 WL 1884041 (E.D. La. 2008). (Katrina’s unprecedented flooding and devastation was an Act of God defense.) In Conagra, supra, Judge Fallon was asked to review a contract of affreightment for a cargo of wheat aboard a barge that sunk. Memco was found not negligent in delivering its barge of cargo to an affected berth several days before the weather forecast accurately predicted the landfall of Katrina.

In re S.S. Winged Arrow, 425 F.2d 991 (5th Cir. 1970), affirmed that where a vessel had been sufficiently moored based upon the anticipated path of Hurricane Betsy, the Act of God defense applied to relieve its owner of  tort damages resulting from its breakaway. From a review of the case law involving severe weather events, it is apparent that Act of God defenses will be granted as a defense to both third party tort claims and also contractual claims for failure to perform where reasonable decisions and precautionsunder the circumstances have been made.

B. Performance Clauses

Clauses for demurrage, detention or laytime usually involve delays in the loading or unloading of cargo or the delivery of goods and materials. Laytime is the period of time allowed for loading and unloading. Demurrage and detention are sums paid to compensate for time lost related to the delivery of equipment or cargo. Demurrage begins to run after the passage of laytime or the agreed time of delivery and performance. Damages are awarded for failure to perform. Deviation is an obligation to maintain a proper course in ordinary trade and to timely arrive at the agreed destination. All deviation clauses are subject to certain liberties. Any deviation may affect insurance and hire.

Typically a contract for maritime services can be terminated for cause or for convenience. Similarly, parties may negotiate terms to suspend performance, which would suspend payment of hire and performance of services. A suspension clause is typically an off-hire clause where the contract terms remain but no hire is paid. Usually a vessel owner will be compensated and reimbursed for certain additional expenses if a contract is terminated for convenience. An Act of God clause excuses delays in performance, but in most cases serves to either suspend performance or terminate the contract for cause as between the parties.

Similar defenses are also statutorily allowed under COGSA. Under the COGSA “perils of the sea” defense, a carrier and vessel are not liable for cargo damage proximately caused by an Act of God where the carrier is not independently negligent and its vessel seaworthy when confronted with an unexpected and abnormal event of nature. 46 USC 1304(2) (c) & (d) ; J.Gerber & Co. v S/S SABINE HOWALDT 437 F.2d. 580 (2nd Cir. 1971); Taisho Marine & Fire Ins. Co. v. Sea-Land ENDURANCE 815 F. 2d. (9th Cir. 1270).

C. Conclusion

The purpose of an Act of God clause in a contract or asserted as a defense to a maritime tort is to relieve a defendant from liability for performance and damages where there was an extreme natural event. Whether a particular storm or natural event is considered an ACT OF GOD is a question of fact. The factors to be considered in accessing an ACT OF GOD/FORCE MAJEURE include the intensity of the natural event and whether the conditions would normally be expected. In order to avail oneself of the ACT OF GOD defense a defendant must show a causal connection between the loss and the peril as well as defendant’s freedom from fault.

This post was written by Grady S. Hurley of Jones Walker LLP © 2017

For more legal analysis go to The National Law Review

Contingent Business Interruption Coverage: Insuring the Far-Reaching Effects of Tropical Storm Harvey

Manufacturers and producers are keenly aware of the value provided by business interruption coverage. Typically, this coverage is sold to companies as one of several coverages under their commercial property insurance package. Business interruption coverage is generally triggered by physical damage to a company asset (e.g., a manufacturing plant), which causes a suspension of business activities resulting in a loss of business income.

Tropical Storm Harvey has forced manufacturers and producers across Southeastern Texas to shut down operations while repairing their damaged facilities. These companies will turn to their business interruption carriers to recoup their business income lost during this period. However, for companies doing business in that region, but physically located outside the reach of Harvey, business interruption coverage may not protect them from lost profits caused by the storm.

For example, say a company owns a manufacturing facility in California where it assembles cars. The manufacturer purchases its engines from a company located in the flood-ravaged portions of Texas. If the Texas company is unable to build and deliver engines to California, the manufacturer might be unable to assemble cars for days, possibly weeks. Any business income losses incurred by the California company are unlikely to trigger standard business interruption coverage because the California manufacturing facility did not suffer any physical damage. To fill the gap, manufacturers and producers often purchase contingent business interruption coverage (CBI).

CBI coverage is, in effect, an extension of business interruption coverage to the business activities of suppliers and customers. If an upstream supplier or downstream customer suffers an interruption in business activities, CBI coverage should kick in to reimburse the policyholder for certain lost profits. CBI coverage can be written on specific properties owned by suppliers or customers and/or on a blanket basis.

The value of CBI coverage may vary depending on the precise language of the coverage grant.

Compare Millennium Inorganic Chems. Ltd. v. National Union Fire Ins. Co., 744 F.3d 279, 285-86 (4th Cir. 2014) (CBI coverage was expressly limited to “direct contributing properties” therefore, the presence of an intermediary between policyholder and supplier precluded coverage) to Archer-Daniels-Midland v. Phoneix Assur. Co., 936 F. Supp. 534, 544 (S.D. Ill. 1996) (CBI coverage was not limited to “direct suppliers,” therefore, CBI coverage was appropriate despite an intermediary in the supply chain).

There are a myriad of issues that arise when a company tenders a claim for CBI coverage, all of which need to be carefully considered on a case-by-case basis. For manufacturers and producers that rely on companies in Southeastern Texas, CBI coverage may become vital.

This post was written by Joshua B. Rosenberg of BARNES & THORNBURG LLP© 2017

Important New Law in UK Relating to Payment of Insurance Claims

insuranceAt the moment, English law says that insurers and reinsurers are not under a positive duty to pay valid claims within a reasonable time.  If an insurer/reinsurer delays in paying a claim, or fails to pay at all, an insured/reinsured can only claim the sums due under the policy and interest.  An insured/reinsured cannot claim damages for late payment if it suffers additional losses by reason of a delay.

That position will change after 4 May 2017 when certain parts of the Enterprise Act 2016 introduce a new section 13A into the Insurance Act 2015.

The result of the new legislation is that any insurance/reinsurance (including retrocession) policy issued or renewed after 4 May 2017, and which is subject to English law, will contain an implied term that requires an insurer/reinsurer to pay claims within a reasonable period.  If they act in breach of such a term, then they are potentially liable to pay contractual damages to the insured/reinsured as well as due under the policy and interest.

Going forward there is likely to be debate about what constitutes “reasonable time,” but it will include giving time to an insurers/reinsurer to investigate and assess the claim. And what is “reasonable” will turn on issues such as the type of insurance in question, the size and complexity of the claim, compliance with relevant statutory and regulatory rules/guidance and factors outside an insurer/reinsurer’s control.

The new legislation also provides a defence to an insurers/reinsurer and they will not be in breach of the implied term if they can prove that they have reasonable grounds for not paying the claim. The manner in which the claim is handled will therefore be a factor in determining whether there has been a breach of the implied term.

An insured/reinsured must issue the court claim for damages within one year of the date that the insurer/reinsurer pays all sums due under the insurance contract. This introduces a new limitation period for legal claims under English law.

Insurers and reinsurers should note that it will be possible to contract out of the new provisions provided they do so in a transparent manner and draws this to the insured’s attention before the policy is entered into.

Comment

Whilst on the face of it this is all good news for insureds, insurers can take comfort from the fact that claims for breach of the implied term will not be straightforward and may not therefore be widespread.  In particular, insureds/reinsureds will still have to satisfy the Court on issues such as causation, remoteness and mitigation before a claim can succeed.  And insurers/reinsurers will only be liable for foreseeable losses suffered by their insureds/reinsureds.

Going forward, practical steps to be taken by insurers include responding promptly to an insured’s request for claims’ information, continuing to carefully document the claims process and to consider making interim payments to an insured if appropriate. These will significantly improve the chances of an insurer/reinsurer successfully defending any legal actions taken by insureds/reinsured alleging a failure to pay a claim within a reasonable time and claiming damages.

© Copyright 2017 Squire Patton Boggs (US) LLP

Hurricane Matthew Insurance Tips for Businesses

Hurricane map, Hurricane MatthewWith Hurricane Matthew downgraded to a tropical cyclone, it is time for affected businesses, property owners, and insurers to focus on quantifying the amount of damage caused by the storm.  By some estimates, Hurricane Matthew will generation over 100,000 insurance claims and between $4 billion and $7.5 billion in property losses.  Although the focus is typically on pre-storm preparation, the immediate steps taken this week will be important to any business owner seeking to present an adequate claim to its insurer for property damage.

Safety is always the first priority. Do not put yourself, your employees, or first responders in danger. Currently in North Carolina, the predictions are for worsening flooding in many low lying parts of the eastern part of the state, with peak flooding not reaching some areas until Wednesday (four days after the storm passed).

Once the threat of imminent danger has receded, the next step should be to document your loss.  Thorough documentation of the damage to your property will be invaluable.  Hopefully you will also have photographs or video from before the storm, so that any claim presented to an insurer can show both the before and after photographs of the condition of the property.  Because cell phones and digital cameras are not limited by physical film, do not hesitate to shoot dozens or hundreds of photographs.  Videos may be helpful as well.

At the same time you are documenting the damage, you should immediately put your insurer on notice of the loss.  You should call your insurer to begin putting them on notice as soon as you arrive at the property if you assess any physical loss.  After you give initial notice, you can follow up with complete details, provide the photographs you have taken, etc.  The insurer will likely eventually send an adjuster to physical inspect the damage to the property.

It is important to quickly give notice for several reasons.  As a legal matter, giving prompt notice prevents having a claim denied by an insurer on the basis of a late notice defense.  As a practical matter, because of the large number of claims that will be filed within a short period of time, some insurers will likely handle the claims on a first-come, first-serve basis.  Getting your claim in quickly gets you closer to the front of the line.

If immediate repairs are needed, take plenty of additional photos of the damage, the repairs in progress, and the final repairs.  Maintain copies of documentation regarding the repairs, and provide those to your insurer.  If your business had to buy or rent additional equipment as a result of the damage, or you suffered inventory loss, you will want to maintain detailed documentation of these costs as well.

Finally, whichever employee you assign to provide information to the insurer should maintain a journal or notebook.  This should include copies of all documents submitted to the insurance company, along with a log of all conversations with the insurer or its representatives.  The log should include the contact information of anyone from the insurer that you have contacted with, the date and time, the topics you discussed, and any additional information which you believe may be useful in the future or in the event of a dispute.

Copyright © 2016 Womble Carlyle Sandridge & Rice, PLLC. All Rights Reserved.