Insurer: ‘Not Liable For Breach Costs’

A Colorado insurance company has filed a federal lawsuit saying that it should not be held responsible for reimbursing the University of Utah for $3.3 million in costs related to a 2008 data breach at the university's hospital system.

The university asserts that Perpetual Storage, the third party company responsible for housing the university's data, is responsible for covering the costs associated with the breach, in which 1.7 million patient records were exposed when data tapes were stolen while en route to a Perpetual Storage facility, according to a Chronicle of Higher Education report. The Colorado insurance company, Colorado Casualty Insurance Co., is Perpetual Storage's breach insurance provider.

The data tapes were recovered untouched a few days later, according to a Computerworld report. But the university said it spent $3.3 million informing patients in its healthcare network about the breach, as well as running up telephone bills, assuming credit-monitoring expenses, and taking on other miscellaneous costs.

Colorado Casualty's lawsuit complaint, asking for a declaratory judgment in its favor, does not explain why it believes it is not obligated to pay the breach-related costs.