Appeal Over Stay In Federal Court In Cyber Coverage Dispute Continues While State Court Action Proceeds
Time 2 Minute Read
Categories: Cyber

In a recently filed brief in the Ninth Circuit, Cottage Health argued in support of the federal district court’s stay of Columbia Casualty’s lawsuit against Cottage Health in favor of Cottage Health’s parallel state court lawsuit against Columbia Casualty.

Cottage Health operates hospitals in California. In 2013, it suffered a data breach resulting in the disclosure of patients’ private medical information. Columbia Casualty had issued a “NetProtect360” policy to Cottage Health that provided coverage for privacy injury claims and privacy regulation proceedings. After the patients filed a class action against Cottage Health, Columbia paid $4.125 million to settle the lawsuit, $170,000 in defense costs, and $900,000 in expenses for responding to the data breach, including costs for notifying the patients and retaining forensic experts to identify the cause of the breach. Columbia paid all of those amounts subject to a reservation of rights to recoup its payments from Cottage Health. The reservation was based on Columbia’s position that Cottage Health had misrepresented compliance with risk control procedures explained in the insurance application.

After the parties completed a mandatory alternative dispute resolution process, they filed competing lawsuits regarding coverage. Columbia filed in federal court and Cottage Health filed in state court. The federal court granted Cottage Health’s motion to stay the federal case given the ongoing state court case. It found that several factors applicable under the Colorado River doctrine weighed in favor of a stay, including avoiding piecemeal litigation, the applicability of California law, the adequacy of the state court proceeding, and the comprehensive nature of the state court suit. Columbia appealed and the parties are now briefing the proprietary of the federal court’s stay. The state court case is pending and a motion for summary judgment was recently filed.

The case is a good reminder of the many ways that coverage disputes can devolve into complex litigation – even after an insurer agrees to cover defense costs and pay a settlement, albeit under a reservation of rights. The expense of such disputes, on top of the experienced loss, can often be debilitating to an “insured” business. To avoid these problems (if possible), policyholders must pay careful attention to application-stage representations and the terms of the policies they purchase, as well as how the claim is presented to the insurer.

We will continue to monitor the case.

  • Counsel

    Patrick counsels clients on all aspects of insurance and reinsurance coverage. He assists clients in obtaining appropriate coverage and represents clients in resolving disputes over coverage, including in litigation and ...

You May Also Be Interested In

Time 1 Minute Read

On February 6, 2026, the Federal Trade Commission announced its second report to Congress on its efforts to combat ransomware and other cyber attacks.

Time 2 Minute Read

Congress has extended the Cybersecurity Information Sharing Act of 2015 through September 30, 2026 as part of the Consolidated Appropriations Act, a government funding package enacted in early February 2026.

Time 1 Minute Read

If recent years have taught insurance practitioners anything, it is that the most consequential coverage disputes rarely turn on novelty alone. In 2025, courts continued to resolve high‑stakes insurance disputes by returning to first principles—examining when claims are related, how losses and occurrences are defined and aggregated, and how policy language allocates risk across time and conduct. D&O coverage and other core insurance law issues again occupied center stage, while decisions in property, cyber, and liability disputes reinforced a familiar theme: policy interpretation remains the decisive factor in determining whether coverage is available in an increasingly complex claims environment. As the decisions discussed below demonstrate, 2025 confirmed that even as risks evolve, coverage disputes remain grounded in careful, policy‑specific analysis.

Time 2 Minute Read

The New York Office of the Attorney General recently reached a $500,000 settlement with a New York orthopedics practice for allegedly failing to protect patient and employee information in light of a 2023 data breach.

Search

Subscribe Arrow

Recent Posts

Categories

Tags

Authors

Archives

Jump to Page