Is Colorado Casualty the Devil?

It’s getting pretty ugly over there in Utah.   What’s that have to do with Colorado Casualty?  Wait for it, we’ll get there.  Anyway, long story short: University of Utah had some backup tapes containing ePHI for about 2 million patients (containing patient medical records from the university hospital) go missing on their way to an offsite storage provider.  The University spent about 3.3 million dollars making up for the trauma from this whole situation – a hefty bundle, but probably not as bad as it could have been (just over 1.5 USD per record – not a bad metric as these things go).

Anyway, here’s where it gets juicy.  Now, the University seeks reimbursement of their 3.3M.  Why not?  It wasn’t their fault that the tapes went missing.  And they (thoughtfully) used a storage provider who was insured against breaches.  Good planning (or so one might think) on the part of the University.  However, the storage provider apparently uses Colorado Casualty Co., as the provider of their breach insurance.

Now not only has Colorado Casualty said that they are not responsible for paying anything to the University, but in a move worthy of Emperor Palpatine himself, they’ve  actually taken it one step farther and filed a federal lawsuit in Utah seeking protection for any claims that the University might make against the storage provider.   So if the University wants their money, someone’s going to have to sue them for it.

Nobody seems to know what their reasoning might be for why they don’t have to pay.  In fact, one might wonder what the value actually is in carrying breach insurance if there’s a costly legal struggle involved in actually making a claim.  I’m sure I don’t know.  But in the meantime, my recommendation is to avoid Colorado Casualty like the plague since they’ve tipped their hand for how they handle situations like this one.