Fidelity bond covering “a fraudulent entry of Electronic Data or Computer Program” covers fraudulent entry into the system, not fraudulent data.

A rider in a fidelity bond for computer systems fraud that covered “a fraudulent entry of Electronic Data or Computer Program” unambiguously refers only to unauthorized access into plaintiff’s computer system and not to fraudulent content that was input by authorized users.   Universal Am. Corp. v National Union Fire Ins. Co. of Pittsburgh, PA., 2015 NY Slip Op 05516, CtApp 6-25-15

Plaintiff Universal Am. Corp. is a health insurer who offers Medicare Advantage plans to Medicare-eligible individuals who purchase Medicare coverage from private health insurers who in turn are reimbursed by the federal Centers for Medicare and Medicaid Services for health care services that are provided to the plans’ members.  Plaintiff’s computerized billing system allowed health care providers to submit claims directly into the system.   Plaintiff automatically processed, approved, and paid most of the claims without manual review.

Plaintiff suffered more than $18 million in losses from paying fraudulent claims for services that were never actually performed under its Medicare Advantage plans.  When plaintiff sought payment from defendant bonding company for plaintiff’s post-deductible losses, defendant denied coverage on the ground that the rider did not encompass losses for Medicare fraud, i.e., losses from payment for claims submitted by health care providers.

Plaintiff sued defendant for declaratory relief and moved for partial summary judgment on the issue of coverage, and defendant cross-moved for summary judgment dismissing the complaint.

The Court of Appeals affirmed dismissal of the complaint, holding that the rider unambiguously applies to losses incurred from unauthorized access to Universal’s computer system, and not to losses resulting from fraudulent content that authorized users input into the computer system.

The Court applied the “reasonable expectations of the average insured upon reading the policy” (from Mostow, 88 NY2d at 326-27).  The Court noted that the intentional word placement of “fraudulent” before “entry” and “change” manifests the parties’ intent to provide coverage for a violation of the integrity of the computer system through deceitful and dishonest access.  The Court also relied on other language in the rider that evinced defendant’s intent to cover only fraudulent access and not fraudulent input.