Download

Why Workers’ Comp Claims Stay So High

This guide helps employers to understand where costs are coming from -- and to decide that they need to make some changes.

In meetings with employers who have a history of high workers’ compensation claims costs and related expenses, we hear a common story: “The insurance adviser does not to take an active role on the problem. The adviser provides little or no supervision of the claims process. Nor are the true costs of each claim incident evident to the employer.”

These employers tell us that they rely solely on the insurance company claims adjuster’s process and the recommended insurance carrier medical clinic treatment protocol. There seems to be no one enhancing communications with the injured employee.

This communication void can lead to misunderstandings and a lack of trust and cause injured employees to seek legal representation. The result can be higher claims costs and delays in closing claims.

In most of these situations, the insurance adviser goes through an annual exercise to obtain rate quotations in an attempt to “control employer costs.”  But the quoting process fails to help the employer understand the costs of each claim. Nor does the process inform employers how to lower costs.

Some time ago, Dave Smith, a safety consultant in Lafayette, Calif., shared a comprehensive list of items and costs that affect employers when a work-related injury or illness occurs. I've attached a copy of Dave’s creation that I share with employers.   

In our experience, this guide helps employers rethink the claims management process and their experience with their insurance adviser. The guide helps employers come to the conclusion that they must make some changes to achieve better financial outcomes.

Cost transparency helps an employer to understand where the costs are coming from. Employers will also be better able to see if they truly have a valuable insurance adviser or if the adviser's process is just too costly.

Many employers seem to forget that it is their money at work in workers' comp claims and that they must be involved in all aspects of their workers’ comp insurance and risk management program.

Remember that the expenses listed in this chart are all in addition to the increase in future workers' comp premiums that come because of the change in the employer’s experience modification factor.

Speed To Detection: A Progressive And Strategic Concept Using Advanced Anti-Fraud Analytics

Insurers must transform strategies for combating complex crime rings.

|
The recent natural disasters in Oklahoma and New Jersey, and the wildfire season in the western United States, have a lot in common when one thinks both of insurance risk — plus the intended and unintended consequences of these events. The insurance industry knows natural disasters will happen. The industry thus creates and follows protocols and response plans. For the most part, the industry and public-safety officials handle the crisis, and restore calm and order in our communities. The insurance industry knows these events will occur, and planning is generally pretty solid per the axiom, "If it's predictable, it's preventable." But in the world of insurance fraud, many sectors of the insurance industry seem to lack the same energy to mitigate this crime. Using the same acumen gained from restoring order after disasters, the key is to apply the same proven strategies of history, response, performance and mitigation of future risks. This approach will better help combat insurance fraud with equal success. The modern strategy of "speed to detection" is a uniting principal and operating strategy for mitigating the epidemic of fraudulent claims. Optimizing speed to detection involves synchronizing all layers of insurer personnel into informed, enterprise-wide fraud fighters. They are well-trained to spot warning signs of this crime, personally motivated, and encouraged to follow internal processes that allow open lines of communication about fraud leads, needed process improvements and action solutions. Bogus claims thus can be discovered and mitigated faster. Quick detection also is an intimidating deterrent that can convince more fraudsters to avoid trying to breach that insurer. The risk of arrest and conviction is too high, and odds of financial reward are too low. Speed to detection is a timely precept: Insurers today are confronting a persistent crime that is morphing, in many respects, to higher levels of sophistication and ability to steal insurance money. Insurance fraud harms law-abiding consumers (higher premiums), aids the underground economy, facilitates other illegal enterprises such as trade-based money-laundering, and poses a public-safety threat (e.g., staged automobile collisions, arson, murder for life insurance, needless medical procedures). Conservatively, fraud steals $80 billion a year across all lines of insurance.1 Some estimates rate the annual losses much higher. And the problem is growing. Questionable property-casualty claims in the U.S. have increased 27 percent in 2012 over 2010, the National Insurance Crime Bureau (NICB) says in an analysis of its database of claims released in May. That reflects 91,652 questionable claims in 2010 compared to 116,171 claims in 2012.2 Similarly, most consumer research reveals a disturbing public cynicism about this crime, and even a backslide toward higher consumer tolerance of fraud.3 Confronting this epidemic is a large network of organizations dedicated to minimizing fraud as a virulent national threat. Insurance companies have teams of experts (the Special Investigation Unit, or SIU) trained to deal with suspicious claims. State law-enforcement agencies have created specialized departments and bureaus dedicated to thwarting this crime. State insurance departments have strengthened their processes for identifying, investigating and reporting suspicious claims for potential prosecution. States also have enacted numerous fraud laws and regulations that further strengthen enforcement. More are being added or bolstered every year. At first glance, these processes appear sound, prudent and presumably effective. A lot of money, personnel and effort have been thrown at insurance fraud. Shouldn't schemes be going down instead of up? Or at minimum, leveling off? Many of the following observations are guided by my 32 years of combating insurance fraud, including several years as a Bureau Chief, and one year as the Division Chief with the nation's largest anti-fraud unit, the California Department of Insurance, Fraud Division. Some academic backup also is cited for added information. Despite the large defense shield, growing numbers of insurance executives at the decisionmaking levels — inside and outside the anti-fraud ranks — are frustrated about how fraud persists as a costly national epidemic. To illustrate: In recent years, I have provided consulting and analysis and review of first-party bad-faith cases involving fraud, the actions of SIUs in a claim or series of claims, and expertise for qui tam civil actions by insurance companies. In these many interactions with insurance executives, anti-fraud directors and other colleagues throughout the industry, the frustrated question they ask most often about fraud is: "Why do we keep throwing money at a crime that never seems to go away?" Typically they offer two reasons why fraud remains so vexing and persistent: "The insurance system invites fraud." Indeed, our insurance system is one of the best in the world. But the most skillful fraudsters effectively exploit weaknesses when the system is not synchronized and calibrated among partners to create a hardened shield. "We need the best team to investigate these crimes." Insurance companies and government entities are constantly working to create an elusive Dream Team for investigations. Key ingredients of team members are passion, creativity, and ability to wade through a series of complex conspiracies either to deny a claim, or have an offender arrested and prosecuted. Many insurers are frustrated because qualified people with the acumen to investigate fraud are hard to come by. Time after time, when insurance carriers lose bad-faith lawsuits involving the SIU and fraud, some of the common denominators are training, unqualified people and bad leadership decisions. An important reason fraud appears to keep rising is that insurance companies and regulators are slow to recognize the value and impact of anti-fraud technology leveraged with best business practices. The anti-fraud community needs to rethink its strategies, and examine ways to identify problems and risks before they become crimes. Resources should be synchronized to optimize speed to detection. This requires insurers to have their anti-fraud operations well-aligned with their internal corporate structure, strategies and practices — and with external partners such as state fraud bureaus, law enforcement and NICB. Reaching this goal must start with an honest discussion about technology and other best practices. A major problem is that too many insurers use outmoded methods of fraud detection. These methods have little impact on modern, sophisticated fraud rings that are a significant source of money outflow. Meanwhile, insurance fraud is evolving and organized crime increasingly is infiltrating fraud. Such rings have been around for years, but their sheer number and growing sophistication are changing the criminal landscape. Many insurers aren't equipped to counter this new breed of criminal, especially using indicators. Recently, I gave a presentation at the Insurance Fraud Management Symposium (IFM). This is the largest annual conference of insurer anti-fraud directors, executives and other personnel.4 The presentation covered a major criminal investigation and prosecution involving a staged accident ring in Southern California. This case illustrates two frequent insurer vulnerabilities: a) over-reliance on weak fraud indicators that allowed fraudsters to penetrate the insurer's anti-fraud defenses relatively easily; and b) how vulnerable insurers become when they compromise their business processes by speeding up claims payouts by compromising vigilance. The leader of this criminal enterprise joined me in the presentation. He was under court order to assist the California Division of Insurance in public education after his conviction. He related how he ran the operation, who he involved, and how and why he targeted specific insurance companies with bogus injury claims from the setup collisions. He made a chilling point: "You will never win the war on fraud." He urged insurers to avoid over-reliance on the so-called "indicators" they use to identify fraudulent claims. Indicators are a relatively basic investigative tool. Insurers look for specific actions or behaviors that are red flags of possible fraud during the claims process. With staged accidents, for example, indicators might include flags such as multiple people in both vehicles, expensive treatment at the same clinic, and similar last names to suggest a possible family fraud ring. This ringleader knew the indicators well, probably better than some claims staff. Thus he could rig his crashes and phony claims to easily avoid being detected by common flags. Just as important, he also relied on inexperienced and untrained claims representatives to give in and pay claims with little scrutiny. "It is a game of poker: Who is going to bluff the best, and who will stay in the game with a winning hand?" he warned. In a similarly illustrative case, Greg Foshee was educated, articulate and knew the insurance claims system well. He should have. Foshee was a claims representative for one of the nation's largest property-casualty insurers. He saw large profit potential when his supervisor ordered him to "just process the claims." So Foshee went to the "dark side." He started staging vehicle accidents and then helped process the ensuing bogus injury claims without insurer scrutiny. He staged more than 82 vehicle collisions that stole $1 million worth of insurance money. During questioning after his arrest, Foshee said his supervisors told him: "Don't ask too many questions, just get the claims off your desk." Foshee used multiple individuals with multiple valid drivers licenses from several states. He kept the operation simple to avoid detection. He had only 13 ring members, with just three cohorts working full time and controlling the group. Nor did Foshee involve attorneys and physicians. They would have slowed the claims, and he would have had to split the ill-gotten insurance money with them. He made smaller claims just for vehicle damage and minor medical treatments in order to stay under insurer radars. The treatments usually consisted of an emergency-room visit for subjective injuries such as whiplash that are typically associated with minor traffic accidents. Foshee also knew that if his ring members went to emergency rooms too often in a given city, someone might notice and start asking questions. So instead he created false medical bills and treatment reports using letterhead and forms stolen from the hospital. If the targeted insurance companies had simply called the hospitals to verify patient information, they would have discovered that the so-called patients were never treated there. This would have confirmed that the treatment reports and bills were false. Foshee averaged $10,000-12,000 income per staged accident, and went undetected for several years. He knew how the claims process worked, and how to avoid scrutiny and detection. The California Highway Patrol's Investigations Unit completed the investigation in 1988. Foshee was convicted of insurance fraud, conspiracy, grand theft, and was sentenced to several years in state prison. Let's think about this for a minute ... These aren't isolated cases. Over the last 30 years, large segments of the insurance industry, law enforcement and other government agencies have relied heavily on old-fashioned indicators of false claims, and similar basic tools. These indicators have been identified, written, promulgated, and used in the daily business of receiving and closing insurance claims. Reality check, please? The crime rings knew the insurers' fraud indicators, and avoided them. The insurers also compromised their internal anti-fraud processes to turn around claims quickly. Many other organized fraud groups and bold criminal entrepreneurs like these are operating daily, skillfully compromising the insurer claims systems. Collectively, they likely steal millions of dollars everyday. Whether detected or undetected, usually it is too late to recoup the stolen money. Rethinking The Fraud Fight If speed to detection is to move from an energizing concept to transformative anti-fraud practice, fraud fighters must step out of the indicator box and rethink their entire approach to combating modern, emerging threats such as complex and organized crime rings. Some insurers just seem to be going through the motions of fighting fraud, indicators and all. But the more progressive insurers are transforming their internal cultures and business practices to create a coordinated, enterprise-wide response to this crime. They are taking the fight more directly to the criminal underworld instead of waiting for the underworld to come to them. As a result, these insurers are also far more resistant to schemers of all kinds. Insurance companies and government agencies need the ability to change direction quickly to address emerging fraud schemes, trends and problems. Nimbleness is a key attribute of sophisticated fraudsters. It also should be a core trait of every insurer's speed-to-detection process. The goal is not to eliminate fraud indicators or other basic tools. These tools may play a role in the overall mix of anti-fraud business processes and strategies each insurer custom fits for its own anti-fraud challenges. Several strategic best practices can help optimize speed to detection. Advanced Analytics Advanced analytics rank among today's most transformative best practices for increasing speed to detection and allowing better-informed decision making.5 Analytics involves the discovery and practical use of meaningful patterns of anti-fraud data. Properly marshaled, advanced analytics can quickly move insurers miles beyond indicators. Analytics can reduce the ineffective pay-and-chase mindset of many insurer detection processes. Analytics also can put insurers quickly on the offensive, and thus dramatically increasing speed to detection. Advanced analytics tools come in many flavors. Each organization must customize an analytics strategy to its unique challenges. Rarely is there one off-the-shelf software solution. Analytics solutions increasingly are being adopted by some insurers. Among the solutions that are gaining momentum: Predictive analytics. Allows insurers to uncover suspicious activity in close to real time, and even to forecast the likelihood of potentially fraudulent behaviors. Text analysis. Insurers can ferret out previously inaccessible data such as an adjuster's field notes — even handwritten notes. Social network (link) analysis. Helps an insurer examine relationships among organizations, people and transactions to discover suspiciously related claims that appear unrelated on the surface. Social media analysis. More insurers recently have begun mining social media for clues. A workers compensation insurer, for example, might uncover a supposedly disabled worker posting photos of his Hawaiian surfing vacation on his Facebook page. But analytics alone — whether advanced or more basic — cannot reverse the tide of fraud. Analytics must be supported by other best practices and processes. Some insurers and smaller regulatory agencies believe the cost of advanced analytics platforms is too high, or that they do not have the data to support such robust systems. But analytics can be affordable by starting small (don't try to boil the ocean), and strategically planning to gradually layer in advanced analytics into the business process and technology platform. Start small, and build upon the new platform incrementally, first addressing immediate business needs and problems. Marshall Big Data Mobilizing big data is gaining wider attention in anti-fraud circles. Insurers are sitting on troves of data, hard and soft. Much is never accessed for fraud-fighting. Insurers can dramatically increase their anti-fraud assertiveness by insightfully accessing, analyzing and mobilizing their large volumes of untapped data. But the terabytes and even petabytes can overwhelm an insurer's analytical capabilities. Insurers must invest in analytic expertise to retrieve, filter and use big data properly. Insurers also must know what questions to ask when mining for big data. This information will be more focused and useful, and avoid the confusion and fuzzy results that too much data can impose. Limit Pay And Chase Insurers must re-evaluate their reliance on the ineffective "pay-and-chase" model that drives the anti-fraud-strategies of so many insurers. Using this model, insurers routinely pay claims and then investigate afterward. But the money is gone by then, and the trail is growing cold. It is rare for an insurance company, self-insured or government program to recover much or any stolen money. In fact, usually no money is recovered. This is especially true of the larger, complex fraud rings that often operate internationally. They are adept at trade-based laundering of stolen insurance money through shell corporations. Some insurance rings are learning from criminal brethren such as drug cartels in Mexico and South America. They are effectively laundering stolen money (e.g., proceeds from human trafficking, firearms and narcotics). They wash the money through sophisticated shell companies and corporations involved in global commerce. The money is difficult, if not impossible, to trace and recover. In the public sector, Medicare once was the poster child for ineffective pay-and-chase practices. But the federal health program for seniors is replacing that approach in part by installing predictive analytics to uncover more false claims before payment. Take On Difficult Cases Simply going after safe, low-level frauds (i.e., low-hanging fruit such as an inflated claim from a home burglary) might look good on the anti-fraud unit's statistics reports. But this also may ignore the largest fraud problems and sources of claims-money outflow such as modern rings that steal safely and efficiently. They often are organized like a classic cell network. Ring members do not know each other, nor do they know all activities in the enterprise. But advanced analytics can expose these complex groups and their crimes much faster and more efficiently. Insurers must commit to taking on the difficult higher-dollar cases such as those perpetrated by organized crime rings, even if it entails considerable cost and personnel. This is essential to diminishing what for many insurers is a significant source of false claims payouts. Collaboration Better collaboration is essential to turning the corner on America's fraud epidemic. This collaboration must include all stakeholder organizations and personnel. Internal. Collaboration within an organization should be an enterprise-wide endeavor and operational commitment. For example, a) agents and brokers must speak with the claims staff; b) claims staff must communicate with the SIU team about suspicious claims; and c) employees at all levels must be encouraged to speak up and identify vulnerabilities, process breakdowns and needed solutions. To underscore this point, visit another statement the fraud-ring member said at the IFM conference: "We know when the insurance company will pay based on the actions and interaction with an inexperienced, and not properly trained, claims representative. And we also know which companies pay claims easily." External. Insurers must retain open lines of communication with state fraud bureaus, local law enforcement, state attorneys general, the FBI and other stakeholders. Insurers in different lines of insurance also must collaborate. Auto, workers compensation and health insurers, for example, may find synergy by comparing best practices and exchanging case leads that may uncover hidden crimes. Insurers in the public and private sectors also must better collaborate for the same reasons. Many organized crime rings, for example, defraud numerous insurance programs. A large Armenian crime ring in California, for instance, staged car crashes against auto insurers and also bilked Medicare. If public and private insurance programs share case leads, they can dramatically increase the joint knowledge base needed to more speedily break down that ring. One promising collaborative effort is the new Fraud Prevention Partnership. It was formally announced last July by HHS Secretary Kathleen Sebelius and U.S. Attorney General Eric Holder.6 Medicare, private health insurers, automobile insurers and others are formalizing closer lines of cooperation. The partnership is building up its operating structure, and partnership members are beginning to share fruitful case leads. It could become a model for collaborative techniques. The Payoff Marshaling analytics and big data with current rules and indicators into a seamless and unified anti-fraud effort creates an expansive world of possibilities. Imagine the ability to search a billion rows of data and derive incisive answers to complex questions in seconds. Imagine being able to comb through huge numbers of claim files quickly. Imagine more-quickly linking numerous ring members and entities acting in well-disguised concert. These suspects likely could not be detected with sole or even primary reliance on basic methods such as fraud indicators. Ultimately, imagine analyzing entire caseloads faster and more completely, thus addressing the largest fraud problems and cost drivers in any of an insurer's coverage territories. Conclusion Insurance companies are not in the anti-fraud business. They are in the business of managing a risk pool, mitigating those risks and returning a fair profit. Government law-enforcement agencies are specifically charged with preventing crime and disorder. To prevent fraud, all involved organizations must scrutinize their systems with a fresh view and openness to evaluating how to better combat this crime. Advanced analytics, coupled with sound business practices and preventive measures, will yield better anti-fraud results. For insurance swindlers, speed to detection should mean speed to jail. 1 Coalition Against Insurance Fraud, estimate of annual fraud losses. 2 U.S. Questionable Claims Report, National Insurance Crime Bureau, May 16, 2013. 3 Four Faces of Insurance Fraud, Coalition Against Fraud, 2007; Poor Service Leads to Fraudulent Claims, Accenture consumer survey, 2010. 4 An Insider's Perspective on Automobile Insurance Fraud — Why It Is So Easy to Steal From Insurance Companies, and What To Do About It. White Paper by SAS, 2013. 5 Competing on Analytics, The New Science of Winning. Thomas H. Davenport and Jeanne Harris, Harvard Business School Press. 2007. 6 New Anti-Fraud Partnership is a Force Multiplier, news release, Coalition Against Insurance Fraud, July 25, 2012.

John Standish

Profile picture for user JohnStandish

John Standish

Chief John Standish, retired, is a 32-year veteran of California law enforcement, first serving in the California Highway Patrol and then in the Fraud Division of the California Department of Insurance. He is currently a consultant to the SAS Institute for the criminal justice-public safety and fraud framework programs.

Analytics: A Religion or a Beauty Contest?

Some still measure the quality of analytics by the quality of dashboards and reports, but effective use of analytics is much more than a pretty visualization.

I had the pleasure of attending a conference on analytics recently. It felt like a religious experience. As each speaker announced a new capability or widget, there was a respectful round of applause from the audience, many of whom, it must be said, work in the back offices of their organizations and probably aren’t allowed out in public very often.

My colleague, who is older and possibly wiser than me from time to time, whispered in my ear that it looked to him very much like a church gathering. The speakers were talking to the "believers" – those who had already got the analytics message and were looking for better ways to implement their insight. And what we had stumbled on wasn’t in fact an analytics conference, but rather a Church of Analytics.

It’s an interesting viewpoint. Isn’t the use of analytics in insurance – and indeed any industry – as much a matter of belief as of technology? A belief that the insurance industry is far too complex to be managed on intuition alone, that data-based insights are increasingly critical. ROIs are important for analytics, of course, but it’s as if you have to take that emotional leap of faith before signing up.

In fact, I’m sensing that organizations are making emotional decisions, then looking for an ROI calculation to justify their decision.

Oddly enough, when I first came into insurance a few decades ago, we used information to support decisions we had already made. If you look hard enough in the data, you can usually find that it supports even poor decisions. I hope that we’ve moved on a bit and now use insight to help organizations make good decisions, not validate poor ones.

What’s this got to do with beauty contests? It’s a brave (or stupid) man who offers an opinion on such a contentious topic, but the point I want to make is that there are those who still measure the quality of analytics by the quality of dashboards and reports. Effective use of analytics is much more than a pretty visualization, in the same way that judges at Miss World are now encouraged to think with a new perspective, about "beauty with a purpose." Check out their site http://www.missworld.com/BeautywithPurpose/, which talks about supporting leprosy and autism projects and daycare units for the disabled.

Good visualization effects are important and help improve user consumption – but effective use of analytics means much more just than a pretty dashboard. It’s the ability to gain better business understanding, support (or create) business strategy and manage progress. As with Miss World, the beauty of analytics is more than skin deep.

Future Is Bright for P&C Agents

For decades, the “experts” have bet against independent insurance agents, yet agents keep winning. Why? Experts underestimate the value of trust.

The experts guaranteed that the Baylor and Alabama football teams would win their bowl games after the 2013 season. Both lost. Baylor was favored by a whopping 17 points over Central Florida but lost by 10, while Alabama was favored by 15 over Oklahoma but got crunched by 14. 

Likewise, for decades, the “experts” have been betting against independent insurance agents, yet agents keep winning. Why? The consultants, finance guys and others who populate the skyscrapers on Wall Street discount the power of the local trusted insurance agent who does business on Main Street.

That’s not to say that the recent report from McKinsey on the future of property/casualty insurance agents should be discounted. It raises some very good points about how insurance agents need to evolve to continue to be the distribution channel of choice in the insurance industry.

McKinsey got some things right, some wrong. Let’s start with the latter.

What McKinsey got wrong

-- The agent’s role hasn’t changed.

Automation has reduced independent agents' role in underwriting and processing, so insurance companies perceive agents are doing less and should get less commission. But the agent’s role has not changed. The client still needs a local, trusted adviser to explain and recommend the proper insurance coverage. Today, that role is valued even more, with trust in big corporations and the government at all-time lows. Cost-cutting is the easy way to increase short-term profits, and the biggest cost for most insurers is commissions. The McKinsey report gives a short-sighted insurance company executive a reason to lower commissions, but companies that reduce commissions will be following a “fool’s gold” strategy producing short-term gains at the expense of the long-term viability of their agent-based distribution.

-- Brand awareness doesn’t translate into customer loyalty.

A talking gecko, the discount double-check, Flo, Mayhem or Farmers University don’t build customer loyalty. They do build customer awareness, so the big insurance companies spend hundreds of millions of dollars on ad campaigns. But being top of mind doesn’t mean the customer will have any loyalty to the company. You can’t create a relationship with a person through advertising. People create relationships--for example, with someone whose son or daughter plays on the same soccer team and attends the same school as the agent's children. The opportunity to establish a relationship is unique to the agency distribution channel. It takes time and effort, but once established the relationship creates strong customer loyalty. That’s why you never see any studies from big consulting firms that ask people whom they trust more – their local agent or the insurance company We all know the answer.

-- Independent agents will gain market share as auto insurance becomes commoditized.

I agree with McKinsey that some parts of the auto insurance market are becoming commoditized but disagree with the conclusion that this will hurt independent agents. Because they can offer multiple carriers, independents will still get the sale. They will just place the business with the best-priced carrier. The big losers will be the captive distribution companies, which will be unable to offer their clients choice.

--A multi-channel distribution strategy ends up cannibalizing agent-based distribution. McKinsey argues that insurance companies must balance their investments among multiple distribution platforms. It sounds reasonable, but in reality it means a company must reduce the amount of money it commits to its agency distribution channel to reallocate its resources to contact centers, web portals, advertising and other costs of building a direct consumer platform. Companies that follow this strategy will discover that they traded valuable multi-line customers for single-product consumers with no company loyalty.

Where McKinsey got it right

-- Agents must evolve in the way they attract and retain their customers.

Absolutely! The cost of technology is dropping so fast that small and mid-sized agencies can now use tools like social media and data analytics that only large companies could afford a few years ago. Local agents need to be able to engage with their customers in real time. That requires they have a digital media and mobile-compatible platform as well as a social media capability to engage with clients and prospects.

-- Agents must be seen as able to handle all of a client’s insurance needs. Product peddlers won’t survive. Agents have to be able to demonstrate the value they add by virtue of their expertise and that their advice can be trusted.

-- Agents must understand the customers they are targeting and stay focused on that segment. One size no longer fits all in today’s insurance market. Independent agents need to understand their target market, the attributes of profitable customers, and how to reach and serve them. Just like the big insurance companies use advertising to create a top-of-mind brand, agents today must become top of mind with their customer segment.

Today, we live in a world that is moving so fast and becoming so much more complicated that people need someone they can trust—and work with conveniently when and where they want. Current trends in the insurance marketplace bode well for the local, trusted, independent adviser who represents the interests of her clients. The McKinsey report supports that conclusion.

Pinch Me! A Healthcare Program That Works

It is with great satisfaction that I can finally recommend a company, Quantum Health, which saves significant money while improving the employee experience. |

Those of you who are regular readers of this column may have noticed my postings usually observe that most vendors don’t save money -- for example, Wellness: An Industry Conceived in Lies, Retractions and Hypocrisy. (Note that this particular article was accompanied by an editorial in which Paul Carroll, ITL’s fearless leader, described how he had asked the perpetrators for rebuttals, but no one had stepped up.) So it is with great satisfaction that I can finally recommend a company to ITL readers: Quantum Health, which really does save significant money while providing a better employee experience. One might ask: “Wait—you just said the wellness industry is conceived in lies, retractions and hypocrisy. How is Quantum any different?” Simple: Quantum isn’t a wellness company. It’s sui generis. If categorized at all, it would be called “coordinated care.” Unlike a wellness program, Quantum doesn't require or even involve health risk assessments, biometric screenings and checkups. Instead, Quantum leaves employees alone unless they’re sick, are high utilizers or ask for help. Unlike wellness programs, Quantum’s offering is not bolted on to existing administrative programs. Instead, it replaces them, assuming most of the member interface functions from the carrier. Whereas, within a carrier, those functions are siloed -- often in different buildings, always with their own budgets, targets and incentives -- Quantum is organized by customer, with all the functions for that customer comingled. The advantage of that arrangement is best described with a story. Once, when I was on a site visit at Quantum, an employee of a new customer called, asking if diabetic shoes were a covered benefit. In most, if not all, carriers, the person answering that query would be evaluated based on accuracy, number of rings, politeness and how many calls they handled that hour. So the person would say "yes" or "no" and then get off the phone. At Quantum, the agent answered the query but was prompted by the supporting software (and by training) to recognize that question as a red flag. Here was an employee whose diabetes was already so advanced he was asking about shoes…and yet he was nowhere in the diabetes registry. A typical carrier wouldn’t find out about this person until after the inpatient claim for his inevitable crash was filed, warehoused, prioritized and queued for telephonic outreach. And then, assuming the carrier had the correct phone number, and this patient answered the call and was receptive, rehabilitation could begin. And yet there he was – right on the phone – asking for help. So the agent probed a little further and then transferred him to a nurse in the same pod, who engaged him right away, almost certainly avoiding or forestalling a future high-cost medical event. This is just one of many examples of touches that allow Quantum to save your clients more money than any other vendor of any other population health management service. I can guarantee this. This performance also does not come on the backs of employees. Satisfaction rates are very high, and no one has to be bribed or penalized to participate, as happens with wellness, where the average bribe/penalty has almost tripled in five years, to $594. Before you get too excited, here are the catches. First, the carrier has to be willing to give up a chunk of its administrative services…and, more importantly, its administrative fees. It is unlikely that the administrative services contract that your client signed anticipated that, meaning the concession has to be negotiated. Second, even once that concession is extracted from the carrier, the incremental fee for Quantum will in total generate a higher total administrative cost -- Quantum fields several times as many member calls, often lasting several times longer than the calls of the carrier being replaced. Third, to encourage inbound phone calls at the right times, like when a specialist referral or other high-cost resource is recommended, you need to tweak the benefits design to vary the co-pays according to whether the employee is willing to take the extra step of a phone call. Because of this financial incentive, these phone calls tend to come in at exactly the right times, when an employee is in the midst of an episode of care, and is about to fall into the "treatment trap." That is the point at which patients are most concerned and most receptive to assistance. All good, except that human resources executives are often reluctant to tweak benefits designs. Finally, Quantum needs to control its growth, because its performance relies to a large degree on staff training and experience. As the only vendor that has cracked the coordinated care nut, they can’t handle all comers. Consequently, they focus instead on large and jumbo employers. Therefore, you would need a minimum case size of 1,000 employees to engage them. Still, the outcomes advantages that Quantum confers are compelling. (Disclosure: There are no disclosures. I am not a shareholder and do not get commissions from Quantum for articles like these.)

Terrorism Risk: A Constant Reminder

If the federal insurance statute is not extended, the availability of terrorism insurance would be greatly reduced in areas with the most need, such as central business districts. 

With just months to go until the year-end 2014 expiration of the government-backed Terrorism Risk Insurance Program Reauthorization Act (TRIPRA), the debate between industry and government over terrorism risk is intensifying.

The discussion comes in a year that marks the one-year anniversary of the Boston Marathon bombing—the first successful terrorist attack on U.S. soil in more than a decade. The April 15, 2013, attack left three dead and 264 injured.

Industry data shows that the proportion of businesses buying property terrorism insurance (the take-up rate for terrorism coverage) has increased since the enactment of the Terrorism Risk Insurance Act (TRIA) in 2002, and for the last five years has held steady at around 60% as businesses across the U.S. have had the opportunity to purchase terrorism coverage, usually at a reasonable cost.

However, should TRIPRA not be extended, brokers have warned that the availability of terrorism insurance would be greatly reduced in areas of the U.S. that have the most need for coverage, such as central business districts. Uncertainty around TRIPRA’s future is already creating capacity and pricing issues for insurance buyers in early 2014, reports suggest.

New Aon data show that retail and transportation sectors face the highest risk of terrorist attack in 2014. Both sectors were significantly affected in 2013, as highlighted by the Sept. 21, 2013, attack by gunmen on the upscale Westgate shopping mall in Nairobi, Kenya, as well as the Boston bombing.

The vulnerability of the energy sector to a potential terrorist attack has also been highlighted following an April 2013 assault on a California power station when snipers took down 17 transformers at the Silicon Valley plant.

The Boston Marathon attack—twin explosions of pressure cooker bombs occurring within 12 seconds of each other in the Back Bay downtown area—adds to a growing list of international terrorism incidents that have occurred since the terrorist attack of Sept. 11, 2001, and highlights the continuing terrorism threat in the U.S. and abroad.

Following 9/11, the 2002 Bali bombings, the 2004 Russian aircraft and Madrid train bombings, the London transportation bombings of 2005 and the Mumbai attacks of 2008 all had a profound influence on the 2001 to 2010 decade. Then came 2011, a landmark year, which simultaneously saw the death of al-Qaida founder Osama bin Laden and the 10-year anniversary of the Sept. 11 attacks.

While the loss of bin Laden and other key al-Qaida figures put the network on a path of decline that is difficult to reverse, the State Department warned that al-Qaida, its affiliates and adherents remained adaptable and resilient and constitute “an enduring and serious threat to our national security.”

A recently published RAND study finds that terrorism remains a real—albeit uncertain—national security threat, with the most likely scenarios involving arson or explosives being used to damage property or conventional explosives or firearms used to kill and injure civilians.

The Boston bombing serves as an important reminder that countries also face homegrown terrorist threats from radical individuals who may be inspired by al-Qaida and others, but have little or no actual connection to known militant groups.

In a recent briefing, catastrophe modeler RMS assesses that the U.S. terrorist threat will increasingly come predominantly from such homegrown extremists, who because of the highly decentralized structure of such “groups,” are difficult to identify and apprehend.

Until the Boston bombing, many of these potential attacks had been thwarted, such as the 2010 attempted car bomb attack in New York City’s Times Square and the attempt by Najibullah Zazi to bomb the New York subway system.

Other thwarted attacks against passenger and cargo aircraft indicate the continuing risk to aviation infrastructure. The investigation into the March 7, 2014, disappearance of Malaysia Airlines flight 370 over the South China Sea aircraft with 239 passengers has raised many concerns over the vulnerability of aircraft to terrorism.

RECENTLY THWARTED TERRORIST ATTACK ATTEMPTS IN THE U.S.
Source: Federal Bureau of Investigation (FBI); various news reports; Insurance Information Institute

Counterterrorism success in 2011 came as a number of countries across the Middle East and North Africa saw political demonstrations and social unrest. The movement known as the Arab Spring was triggered initially by an uprising in Tunisia that began back in December 2010. Unrest and instability in this region continues in 2014 and has spread to other parts of the world with violent protests seen most recently in Ukraine, Venezuela and Thailand.

Another evolving threat is cyber terrorism. The threat both to national security and the economy posed by cyber terrorism is a growing concern for governments and businesses around the world, with critical infrastructure, such as nuclear power plants, transportation and utilities, at risk.

All these factors suggest that terrorism risk will be a constant, evolving and potentially expanding threat for the foreseeable future.

For the full report on which this article is based, click here.

Six Things to Look for in a Workers’ Comp Counsel

Adjusters told me every day what they DIDN’T like about defense attorneys. Seeing an opportunity, I did the OPPOSITE of the complaints.

When I started defending workers’ comp claims 25 years ago, I learned very quickly what carriers and employers wanted from me—because adjusters would tell me every day about what they DIDN’T like about other defense attorneys. Seeing an opportunity, I made sure I did the OPPOSITE of the complaints.

To paraphrase Rod Serling, I am submitting for your approval six things I learned during those formative years that I believe insurance carriers and self-insured employers are looking for in defense counsel.

Independent thought

Workers’ compensation defense attorneys often simply inform clients that the going rate for a standard-type of injury is this or that. While the client certainly needs to know the going rate, that cannot be where the analysis ends. When I represented TWA years ago, the claims manager told me: "Brad, I can hire trained monkeys to tell me to pay the going rate for standard types of injuries. I pay you to do better than that."

I define independent thought to be analysis on not only whether a claim is compensable but also on strategies to resolve the claim more favorably than simply paying the going rate. This means laying out a game plan that includes all necessary steps. It doesn't always work, but I know clients appreciate this analysis on the front end of a claim.

Zealous advocacy

When the vast majority of claims are compensable, defense attorneys (like insurance adjusters) can easily develop the "process and pay" mentality. I define this as simply looking at what it will cost to pay the claim and taking the fastest steps necessary to close the file and move on.

Even on compensable claims, I have found that clients are always happy to also receive (and even expect) a game plan for asserting possible defenses. To promote its $1 Dollar Menu a few years ago, McDonald's had a billboard that said: "$1 Legal Advice -- Plead Guilty." When I hear of a defense attorney simply saying: "Claim is compensable, pay this amount," I always think this is the workers’ comp equivalent of "Plead Guilty." Even if the employer should pay, the client wants zealous advocacy from the defense attorney on how to best reach the goal.

Regular, substantive communication

This may be the most important piece. It can be broken down into two parts - - regular communication and substantive communication.

I've had a plethora of adjusters over the years tell me war stories about their prior counsel, who would never....ever...do anything on claims. One adjuster told me: "All I ever heard from that attorney was the sound of crickets." The defense attorney who does this not only violates the ethical duty to keep his or her client properly informed, but is also an attorney who is dealing with a future ex-client.

Employers and carriers also want substantive updates that demonstrate how the attorney is best representing the employer. Communications, whether by letters or through now-common emails, should always encapsulate where the parties are on a claim and where the defense attorney intends to take it. Letters or emails from the defense attorney that say nothing more than "Look at all of the creative ways I have billed your file this month" is NOT what employers and carriers want.

Understanding what constitutes a win

One common complaint about workers’ comp defense is, “The employer almost always loses.” That raises the question: Just what is a win, and what is a loss?

I try to resist watching legal shows on television because, even when such shows are deliciously complex, the outcome of almost every legal proceeding is either guilty or innocent. If a civil court is involved, almost every verdict is for millions of dollars or nothing even though, in reality, almost everything is resolved within the nebulous middle ground. I guess that’s why it’s called fiction.

In workers’ compensation claims, the vast majority are going to be found compensable by the state division of workers' compensation. But, to borrow some analysis from Monopoly, we’re not faced with a choice between Baltic Avenue or Boardwalk with hotels. Rather, we are more often than not fighting over whether we can buy Pacific Avenue for the price of St. Charles Place.

Because the vast majority of claims are settled, I often wonder if the client views the settlement as a win or a loss. Over the years, I have seen carriers and employers examine the relative value of a settlement by looking through the lens of the following criteria:

  • Is the settlement fair in light of the evidence available and the applicable jurisdiction?  (e.g., Illinois claims settle for far more than Missouri claims even if the injuries are identical.)
  • Was the claim resolved within the established reserves?
  • Were the defenses that were raised truly sufficient to obtain a non-compensable award or were they only good enough to use for settlement negotiations?

Creative attempts at problem-solving

All carriers and employers know that most claims are compensable. Rarely have I had clients who expected an award of “not compensable” on every claim or even on most claims.

But most clients expect the defense attorney to at least examine all potential defenses to evaluate how the assertion of such defenses might affect the value of the claim. 

Despite the lofty views that most attorneys have of our profession, most of our jobs can often be distilled down to this concept: We help our clients avoid obstacles. While this is self-evident in criminal law (obstacle -- the state wants to put client in prison), such analysis is rarely applied to workers’ comp. 

For example, if a claimant states, “My injury occurred on the job,” this may or may not actually be the case. My job as a defense attorney is to identify factual, medical and legal evidence that might persuade the judge that the “work-related” component of the employee’s injury is not as clear-cut as the employee may believe.

I had one case years ago where the employee claimed he was injured on the job. In his deposition, he admitted that he liked to ride the bull in rodeos. It occurred to me that there must be some association that keeps track of who rides in professional rodeos, and I contacted the Missouri Rodeo Association. I was “shocked” (insert mock assertion of surprise here) that the claimant’s medical care ALWAYS seemed to occur exactly one day after he competed in professional rodeos. After I provided this information to opposing counsel, the claim was quickly dismissed.

My point -- the employee’s assertion that he was hurt on the job would normally be sufficient to prove compensability in the absence of other evidence, but my job was to find that other evidence. Carriers and employers want their counsel to explore all possible defenses, even if the probability of success is low, because occasionally (like in my rodeo case) the defenses actually work.

Sticking to your guns

If you ask an adjuster about her greatest pet peeve when it comes to dealing with defense attorneys, one example is most often cited: “I hate it when my defense attorney tells me at the beginning of the case that the claim is only worth $500, and then, on the day of trial, he tries to convince me to pay $20,000 to settle it.”

Years ago, I had a client who pulled files from another attorney and sent them to me. As I reviewed them, I saw a theme. The attorney would often say: "This claim is a fraud, and I wouldn't pay anything more than $500 to settle." But I didn’t see ANY evidence of fraud in many of the files. I was in the unenviable position of having to tell the client that I thought these claims were not fraudulent, and I provided exposure estimates that were far higher than $500.

I was concerned that the client would say: "Gee, Brad, I liked the advice from the prior guy a lot better." However, this did not happen. Instead, I heard this: "I thought the prior attorney was simply telling me what I wanted to hear. That's why I pulled the files and sent them to you."

The lesson I learned here: Clients want the attorney’s honest assessment of the claim, and they don't want the defense attorney to simply tell them what the attorney thinks the client wants to hear. If the client can't rely on my analysis, then I'm not doing my job correctly. If the case is worth $20,000, I must tell this to the client as soon as it becomes possible to arrive at such a valuation. If I wait until the day of trial to disclose the true value of the claim, the client will think that I am simply afraid to take the case to trial.

Conclusion              

One could easily distill all these comments into a single concept: There must be a good working relationship between the defense attorney and the carrier/employer, one that is based on shared values, frequent communication and deliberative communication (meaning the attorney and the client jointly develop the goal for a particular claim and then both take the steps necessary to reach that goal). If reality matches this ideal, the defense attorney and the carrier/employer will probably be working together for a long time.

Another Reason to Consider Cyber Insurance

No firewall is perfect, no security system impenetrable -- yet traditional insurance policies are being rewritten to exclude coverage for data breaches.

Here a breach, there a breach, everywhere a data breach.

Verizon’s most recent 2013 Data Breach Investigations Report remarks that “[p]erhaps more so than any other year, the large scale and diverse nature of data breaches and other network attacks took center stage” this year.1 And no organization is immune from a breach. The last two years have seen some of the world’s most sophisticated corporate giants fall victim to some of the largest data breaches in history. It is clear that cyber attacks -- including data breaches -- are on the rise with unprecedented frequency, sophistication and scale. They are pervasive across industries and geographical boundaries. And they represent “an ever-increasing threat.”2 The problem of cyber risks is exacerbated, not only by increasingly sophisticated cyber criminals and evolving malware, but also by the trend in outsourcing of data handling, processing and storage to third-party vendors, including “cloud” providers, and by the simple reality of the modern business world, which is full of portable devices such as cellphones, laptops, iPads, USB drives, jump drives, media cards, tablets and other devices that may facilitate the loss of sensitive information.

While data breaches and other types of cyber risks are increasing, laws and regulations governing data security and privacy are proliferating. In its most recent 2013 Cost of Data Breach Study, the Ponemon Institute reports that U.S. organizations spend on average $565,020 on post-breach notification alone.3 Companies may also face lawsuits seeking damages for invasion of privacy, as well as governmental and regulatory investigations, fines and penalties, damage to brand and reputation and other negative repercussions from a data breach, including those resulting from breaches of Payment Card Industry Data Security Standards. The Ponemon Institute’s recent study reports that the average organizational cost of a data breach in 2012 was $188 per record for U.S. organizations ($277 in the case of malicious attacks) and that the average number of breached records was 28,765, for a total of $5.4 milion.4 The study does not “include organizations that had data breaches in excess of 100,000” records,5 although large-scale breaches clearly are on the rise. In the face of these daunting facts and figures, it is abundantly clear that network security alone cannot entirely address the issue; no firewall is unbreachable, no security system impenetrable.

Insurance can play a vital role in a company’s efforts to mitigate cyber risk. This fact has the attention of the Securities and Exchange Commission. In the wake of “more frequent and severe cyber incidents,” the SEC’s Division of Corporation Finance has issued guidance on cybersecurity disclosures under the federal securities laws. The guidance advises that companies “should review, on an ongoing basis, the adequacy of their disclosure relating to cybersecurity risks and cyber incidents” and that “appropriate disclosures may include” a “[d]escription of relevant insurance coverage.”6

While some companies carry policies that are specifically designed to afford coverage for cyber risk, most companies have various forms of traditional insurance that may cover cyber risks, including Insurance Services Office (ISO)7 standard-form commercial general liability (CGL) policies. There may be significant coverage under CGL policies, including for data breaches that result in disclosure of personally identifiable information (commonly termed “PII”) and other claims alleging violation of a right to privacy. For example, there is significant potential coverage under the “Personal and Advertising Injury Liability” coverage section (Coverage B) of the standard-form ISO CGL policy, which currently states that the insurer “will pay those sums that the insured becomes legally obligated to pay as damages because of ‘personal and advertising injury.’”8 “Personal and advertising injury” is defined to include a list of specifically enumerated offenses, which include “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.”9 Coverage disputes generally focus on whether there has been a “publication” that violates the claimant’s “right of privacy”—both terms are left undefined in standard-form ISO policies, and courts generally have construed the language favorably to insureds and have found coverage for a wide variety of claims alleging misuse of customer information and breach of privacy laws and regulations.10 There may also be coverage under the “Bodily Injury and Property Damage” section of the standard CGL form (Coverage A), which states that the insurer “will pay those sums that the insured becomes legally obligated to pay as damages because of ‘bodily injury’” that “occurs during the policy period.”11

As courts have found coverage for various types of cyber risks, however, ISO has added limitations and exclusions purporting to cut off CGL lines of coverage. For example, in response to a number of cases upholding coverage for breach of the Telephone Consumer Protection Act, the Fair Credit Reporting Act and other privacy laws, the current ISO standard form contains the following exclusion, which is applicable to both Coverage A and Coverage B:

This insurance does not apply to:

Recording And Distribution Of Material Or Information In Violation Of Law

“Personal and advertising injury” arising directly or indirectly out of any action or omission that violates or is alleged to violate:

  1. The Telephone Consumer Protection Act (TCPA), including any amendment of or addition to such law;
  2. The CAN-SPAM Act of 2003, including any amendment of or addition to such law;
  3. The Fair Credit Reporting Act (FCRA), and any amendment of or addition to such law, including the Fair and Accurate Credit Transactions Act (FACTA); or
  4. Any federal, state or local statute, ordinance or regulation, other than the TCPA, CAN-SPAM Act of 2003 or FCRA and their amendments and additions, that addresses, prohibits or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.12

Insurers have raised this exclusion, among others, in recent privacy-breach cases.13

More sweepingly, as part of its April 2013 revisions to the CGL policy forms, ISO introduced an endorsement, titled “Amendment Of Personal And Advertising Injury Definition,” which entirely eliminates the key “offense” of “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy” (found at Paragraph 14.e of the Definitions section of Coverage B):

With respect to Coverage B Personal And Advertising Injury Liability, Paragraph 14.e. of the Definitions section does not apply.14

And the latest: ISO has just filed a number of data-breach exclusionary endorsements for use with its standard-form primary, excess and umbrella CGL policies. These are to become effective in May 2014. By way of example, one of the endorsements, titled “Exclusion - Access Or Disclosure Of Confidential Or Personal Information And Data-Related Liability - Limited Bodily Injury Exception Not Included,” adds the following exclusion to Coverage A:

This insurance does not apply to:

Access Or Disclosure Of Confidential Or Personal Information And Data-related Liability

Damages arising out of:

(1) Any access to or disclosure of any person's or organization's confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information; or

(2) The loss of, loss of use of, damage to, corruption of, inability to access or inability to manipulate electronic data.

This exclusion applies even if damages are claimed for notification costs, credit-monitoring expenses, forensic expenses, public relations expenses or any other loss, cost or expense incurred by you or others arising out of that which is described in Paragraph (1) or (2) above.15

The endorsement also adds the following exclusion to Coverage B: This insurance does not apply to:

Access Or Disclosure Of Confidential Or Personal Information

“Personal and advertising injury” arising out of any access to or disclosure of any person’s or organization's confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit-card information, health information or any other type of nonpublic information.

This exclusion applies even if damages are claimed for notification costs, credit-monitoring expenses, forensic expenses, public relations expenses or any other loss, cost or expense incurred by you or others arising out of any access to or disclosure of any person's or organization's confidential or personal information.16

ISO states that “when this endorsement is attached, it will result in a reduction of coverage due to the deletion of an exception with respect to damages because of bodily injury arising out of loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data” and that “[t]o the extent that any access or disclosure of confidential or personal information results in an oral or written publication that violates a person's right of privacy, this revision may be considered a reduction in personal and advertising injury coverage.”17 While acknowledging that coverage for data breaches is currently available under its standard forms, ISO explains that “[a]t the time the ISO CGL and [umbrella] policies were developed, certain hacking activities or data breaches were not prevalent and, therefore, coverages related to the access to or disclosure of personal or confidential information and associated with such events were not necessarily contemplated under the policy.”18 The scope of this exclusion ultimately will be determined by judicial review.

Although it may take some time for the new (or similar) exclusions to make their way into general liability policies, and the full reach of the exclusions remains unclear, they provide another reason for companies to carefully consider specialty cyber insurance products. Even where insurance policies do not contain the newer limitations or exclusions, insurers may argue that cyber risks are not covered under traditional policies. The legal dispute between Sony and its insurers concerning the PlayStation Network data breach highlights the challenges that companies can face in getting insurance companies to cover losses arising from cyber risks under CGL policies. Sony argues that there is data breach coverage because “[t]he MDL Amended Complaint… alleges that plaintiffs suffered the ‘loss of privacy’ as the result of the improper disclosure of their ‘Personal Information’ [which] has been held to constitute ‘material that violates a person’s right of privacy’.”19 However, the insurers seek a declaration that there is no coverage under the CGL policies at issue, among other reasons, on the basis that the underlying lawsuits “do not assert claims for … ‘personal and advertising injury’.”20 The Sony coverage suit does not represent the first time that insurers have refused to voluntarily pay claims resulting from a network security breach or other cyber-related liability under CGL policies. Nor will it be the last. Even where there is a good claim for coverage, insurers can be expected to continue to argue that cyber risks are not covered under CGL or other traditional policies.

As far as data breaches are concerned, cyber policies usually provide some form of “privacy” coverage. This coverage would typically provide defense and indemnity coverage for claims arising out of a data breach that actually or potentially compromises PII. By way of example, the AIG Specialty Risk Protector specimen policy21 states that the insurer will “pay … all Loss” that the “Insured is legally obligated to pay resulting from a Claim alleging … a Privacy Event.” “Privacy Event”22 includes:

  1. any failure to protect Confidential Information (whether by “phishing,” other social engineering technique or otherwise) including, without limitation, that which results in an identity theft or other wrongful emulation of the identity of an individual or corporation;
  2. failure to disclose an event referenced in Sub-paragraph (1) above in violation of any Security Breach Notice Law; or
  3. violation of any federal, state, foreign or local privacy statute alleged in connection with a Claim for compensatory damages, judgments, settlements, pre-judgment and post-judgment interest from Sub-paragraphs (1) or (2) above.23​

“Confidential Information” is defined as follows:

“Confidential Information” means any of the following in a Company’s or Information Holder’s care, custody and control or for which a Company or Information Holder is legally responsible:

  1. information from which an individual may be uniquely and reliably identified or contacted, including, without limitation, an individual’s name, address, telephone number, Social Security number, account relationships, account numbers, account balances, account histories and passwords;
  2. information concerning an individual that would be considered “nonpublic personal information” within the meaning of Title V of the Gramm-Leach Bliley Act of 1999 (Public Law 106-102, 113 Stat. 1338) (as amended) and its implementing regulations;
  3. information concerning an individual that would be considered “protected health information” within Health Insurance Portability and Accountability Act of 1996 (as amended) and its implementing regulations;
  4. information used for authenticating customers for normal business transactions;
  5. any third party’s trade secrets, data, designs, interpretations, forecasts, formulas, methods, practices, processes, records, reports or other item of information that is not available to the general public[.] 

There are numerous specialty cyber products on the market that generally respond to data breaches. A policy offering the privacy coverage will often offer coverage for civil, administrative and regulatory investigations, fines and penalties and, importantly, will commonly offer “remediation coverage” (sometimes termed “crisis management” or “notification” coverage) to address costs associated with a security breach, including:

•     costs associated with post-data breach notification

•     credit-monitoring services

•     forensic investigation to determine cause and scope of a breach

•     public relations efforts and other “crisis management” expenses

  • legal services to determine an insured’s indemnification rights where a third party’s error or omission has caused the problem.

Cyber insurance policies offer other types coverages, as well, including media liability coverage (for claims for alleging, for example, infringement of copyright and other intellectual property rights and misappropriation of ideas or media content), first party property and network interruption coverage, and cyber extortion coverage. The cyber policies can be extremely valuable. But selecting and negotiating the right cyber insurance product presents a real and significant challenge. There is a dizzying array of cyber products on the marketplace, each with their own insurer-drafted terms and conditions, which vary dramatically from insurer to insurer—even from policy to policy underwritten by the same insurer. Because of the nature of the product and the risks that it is intended to cover, successful placement requires the involvement and input, not only of a capable risk management department and a knowledgeable insurance broker, but also of in-house legal counsel and IT professionals, resources and compliance personnel—and experienced insurance coverage counsel.

'Lego Blocks' for Setting Strategy and Planning Projects

Business frameworks have become a best practice to model processes, technology and organization and visualize the future of an organization.|

Business frameworks have become a best practice to model processes, technology and organization. Frameworks help visualize the landscape of the current and future states of organizations. Whether they are called capability maps or business architecture frameworks, they are industry reference models that can be used to plan, analyze, develop, manage and maintain.

With everything that is happening in the insurance industry and with the never-ending announcements of new technologies and competitors, companies need to define their business directions and how they can differentiate themselves. This is where business frameworks become an asset.

What is an enterprise business architecture framework? It is a representation of an organization’s business composition. It describes the functions at various levels of details, including information structures and the natural dependencies found between functions. Frameworks are used as a map to describe various aspects of organizations. They are the Lego blocks of an industry.

Those Lego blocks can then be enhanced and layered with what is specific to each organization. For example, companies may add some of the following perspectives to industry business frameworks to better describe themselves:

  • Enterprise ecosystems
  • Organizational structures
  • Roles and accountabilities
  • Processes and procedures
  • Geographical map
  • Risk assessment heat map

Whether to use an existing business framework or create one is an important question to answer. There are only a handful of comprehensive business frameworks available on the market for the insurance industry. The most known ones are ACORD and Panorama 360. Yet, available industry business frameworks can serve as accelerators for organizations. For management consulting organizations or technology vendors, an existing framework can provide credibility and structure to their offerings.

The true benefits from using industry business frameworks are speed, quality and cost reduction. This is true for defining strategies, planning projects or investments, analyzing situations, developing processes, defining technology requirements and managing organizations. Frameworks can be used for situations such as:

  • Enterprise or business architecture
  • BPM or process improvement
  • Business requirements definition
  • Software evaluation
  • Application architecture
  • Data warehouse architecture
  • System integration
  • Application portfolio management
  • Operational risk management
  • Mergers and acquisitions
  • Data security management
  • Knowledge management
  • New employee training

Business frameworks can significantly leverage single projects or organizations. They provide a return on investment in the short and in the long term. They become an asset base for knowledge.

States of Confusion: Workers Comp Extraterritorial Issues

Employees who work across state lines raise potentially serious workers comp issues because of the mishmash of state laws.|

sixthings
As states passed workers compensation laws, each state established its own system. This resulted in a mishmash of laws, benefits, compensability and eligibility from state to state. Courts have ruled that a state has the right to apply its own workers compensation rules and standards to each case. Hence, most states simply don’t care what other states allow, only what is required under their workers compensation laws. There is little meaningful cooperation or coordination among states. Challenges for agents, employers, insurance companies and adjusters include understanding:
  • When coverage is required in jurisdictions where the employer has operations or employees working, living or traveling in or through.
  • How coverage is provided for various jurisdictions.
  • What jurisdictional benefits an employee can collect.
The policy The two items that reference what states are insured under a workers compensation policy are 3.A. and 3.C. on the information page. (Federal coverage can only be added by endorsement.) 3.A. is fairly simple. The insurance agent for the employer instructs the insurance carrier to list the states where the employer operates when the policy goes into effect or is renewed. 3.C. is a safety net – at least most of the time. That item lists states where an employer expects it may have employees traveling to or through or working in. If an employer begins work in any state listed in 3.C. after the effective date of the policy, all provisions of the policy apply as though the state were listed in 3.A. Notice must be given “at once” if work begins in any state listed in 3.C., although “at once” is not defined in the policy. If the employer has work in any state listed in 3.C. on the effective date of the policy, coverage will not be afforded for that state unless the carrier is notified within 30 days. It should be noted the insurance policy does not determine what law applies at the time of injury. The law determines what is payable. In addition, note that the workers compensation policy does not apply to Ohio, North Dakota, Washington and Wyoming, “monopolistic” states where coverage may only be purchased from the state. Although larger employers may self-insure in Ohio and Washington (but not North Dakota or Wyoming), no private insurance carrier can write workers compensation coverage for an employer. It would seem the safe bet is to add all states except monopolistic states to 3.A. However, most underwriters are unwilling to do this or even add the ideal wording for 3.C.: “All states, U.S. territories and possessions except Washington, Wyoming, North Dakota, Ohio, Puerto Rico and the U.S. Virgin Islands and states designated in Item 3.A. of this Information Page.” The reason for the underwriters’ unwillingness varies. Common reasons underwriters provide include: Licensing issue The insurer is not licensed in all states. Many regional insurers are only licensed in a handful of states while other carriers may only be licensed in one state…often for strategic reasons. Carriers frequently assert it is impossible — and possibly illegal — to list a state they are not licensed in (even though policies contain wording whose clear intent is to allow carriers to pay benefits in states where they are not licensed). Underwriting considerations The insurance carrier may not want to provide insurance in certain states it considers more challenging from a workers compensation standpoint or because carriers do not want to write in states where they have little or no claims adjusting experience, established provider networks and knowledge of the nuances of the law. Underwriters’ lack of awareness or knowledge Underwriters are not claims adjusters and do not always have a full understanding  of workers compensation's jurisdictional complexity and the employer's risk (no coverage) and agents' risk (errors and omission claims) for not securing coverage for all states with potential exposure. Agents are often told the employer does not need coverage in the state in which the agent is requesting coverage — which the home or primary state benefits will pay. However, the chance that an employee will be successful in securing another state’s benefits — even if the employee is only there temporarily — is just too much of a risk. Physical location Carrier underwriters frequently cite the “physical location” — actually needing an address — as a roadblock to adding a state to 3.A. The National Council for Compensation Insurance (NCCI) has rules on this issue. Most states that follow NCCI rules allow entry of “no business location” — but not all.  States that follow NCCI rules (including the independent bureaus like Texas) will often modify some rules. Arizona, Kentucky, Montana and Texas do not allow “no business location.” It is a regulatory reporting issue. Possible solutions to secure 3.A. coverage include:
  • Providing an entry of “Any Street, Any Town” or “No Specific Location, Any City” for the state. Many carriers will use this.
  • Using an employee’s home address in the state if there is an employee working from home there.
  • Using the agent/brokers address if they have an office there.
Compliance Only Texas and New Jersey have workers compensation laws that are elective. New Jersey employers still, in effect, cannot go without workers compensation insurance. In Texas, any employer can “unsubscribe” to the workers compensation system and “go bare” and be subject to the tort system. All other states require employers to purchase workers compensation insurance for their employees or qualify for self-insurance. Which benefits apply?  If an employer has employees traveling on a limited basis from their home states, the headquarters state may have established a time limit on coverage for out-of-state injuries. The most common limit is six months. This may be written into the statute or may be silent, but over time case law has made determinations. In other words, if an employee usually worked in Michigan but spent three months working on assignment in Kentucky and was injured in Kentucky, the employee would most likely still be eligible for Michigan benefits. In states with a timeline, an employee working in another state for more than the designated duration is no longer entitled to benefits in the home state, but the employee is probably entitled to the compensation in the state in which he or she is currently working. One of the most important factors is that an employee injured outside of his state of residence may have selection of remedies (benefits) if he lives in one state and works in another. The Michigan employee injured in Kentucky may want Kentucky benefits because Kentucky has lifetime medical and Michigan does not. Or, an employee may have been injured on the way to work, and the state where she was injured does not allow for workers compensation in this circumstance even though this would be a compensable injury in the employee’s headquarters state. Perhaps there is a disqualification in one state because of, for example, an employee’s intoxication that would not be a disqualifier in another state. In addition, the maximum amount of income benefits available to employees varies considerably from state to state. Piggybacking benefits Piggybacking occurs when an employee files in one state and then in another state where he qualifies for additional benefits. What is allowed in additional payments will depend on the circumstances of the claim and the states involved. This issue has become particularly dangerous for employers that have not arranged coverage in other states because they are unaware there is an exposure there. The employer then becomes liable for the benefits due in the uninsured state, including all costs to adjust and defend the claim if litigated. Typically, if an employee collects benefits in one state and is successful in perfecting a claim in another state with higher benefits, the benefits collected in the first state are offset from the second state’s benefits payment. For example, assume an employee collects $10,000 from Indiana then files in Illinois, which grants $18,000. Only the difference between $18,000 and $10,000, or an additional $8,000, would be paid. Employers with employees in both "wage-loss" and "impairment" states face an additional challenge: Employees could qualify for both states' benefits with no offsets. Most states don’t care what other states have allowed, only what is required under their laws. If the employee collected under another state’s law but qualifies in our state for additional benefits, well, so be it. If an employee has traveled to, through or lived or worked in another state to create a “substantial” relationship with the state, there is a very good chance he or she will be granted workers compensation benefits in that state. State statutes, case law, common law and tests State statutes, case law or the common law in a jurisdiction may influence what benefits an employee may collect. Various criteria that may apply include:
  • State of hire
  • State of residence
  • State of primary employment
  • State of pay
  • State of injury
  • State in agreement between employer and employee (unique to Ohio, and only Ohio and Indiana recognize the agreement)
The “WALSH” test is a good guide to questions to ask, in order of importance: W   Worked - Where did the employee work most of the time? A    Accident – Where did the accident occur? L    Lived – Where is the employee’s home? S    Salaried – Where is the employee getting paid from? H    Hired – Where was the contract of hire initiated? Just about all jurisdictions indicate an employee is entitled to the benefits of their state if the employee was working principally localized in the state, was working under a contract of hire made in the state or was domiciled in the state at the time of the accident. This is why “worked” and “accident” are given the most weight. Reciprocity Several states will reciprocate another state’s extraterritorial provisions. Each state has its own reciprocal agreements, with as few as a half-dozen states or as many as 30. For as many states that cooperate with reciprocity, just as many states will not. In addition, not all reciprocity agreements address the “claims” aspect of compliance. In other words, the reciprocity means the employer does not have to secure “coverage” for an employee temporarily in another state; however, it does not mean that the employee could not pursue a claim in that state. If the employer was relying on the reciprocity provisions of the state law and did not secure coverage in that other state, the employer may be without coverage for that state and may also become “non-compliant” with the state and be subject to fines. The employer (or its agent) has decided to rely on the employee accepting his home state benefits. If the injured employee goes back to her home state for benefits, no harm, no foul.  However, if the employee perfects a claim in another state or in some instances simply chooses to file a claim in that state, then the employer would be considered a non-complying employer and could be subject to penalties. Washington does not reciprocate in construction employment unless there is an agreement in place. Washington has these agreements with Oregon, Idaho, North Dakota, South Dakota, Montana, Wyoming and Nevada. Some specifics Massachusetts, Nevada, New Hampshire New Mexico, New York, Montana, and Wisconsin require coverage in 3.A. Kentucky allows no exceptions for family members, temporary, part time or out-of-state employers performing any work in the state of Kentucky. Kentucky does not accept the Ohio C110 form. New York made a significant change in its workers compensation law [Section 6 of the 2007 Reform Act (A.6163/S.3322)] that affected employers if they conducted any work in New York or employed any person whose duties involve activities that took place in New York. Effective Feb. 1, 2011, the New York board clarified coverage requirements. Detailed information can be found on the New York Workers Compensation Board’s website: http://www.wcb.ny.gov/content/main/onthejob/CoverageSituations/outOfStateEmployers.jsp Florida, Nevada and Montana require all employers working in the construction industry to have specific coverage for their state in 3.A. Ohio and Washington require that employers purchase coverage from the state for all employers working in the construction industry. Otherwise, Florida, Nevada, Montana, Ohio and Washington will honor coverage for temporary work from other jurisdictions. Florida also requires the coverage be written with a licensed Florida carrier. 3.A. coverage status is required for any employer having three or more employees in New Mexico and Wisconsin even on a temporary basis. The standard workers compensation policy exclusion for bodily injury occurring outside the U.S., its territories or possessions and Canada does not apply to bodily injury to a citizen or resident of the U.S. or Canada who is temporarily outside these countries. State workers compensation will apply, however, for those employers that have employees regularly traveling out of the country; the Foreign Workers Compensation and Employers Liability endorsement should be added to their workers compensation policy. This endorsement is used for U.S.-hired employees who are traveling or residing temporarily outside the U.S. The coverage is limited to 90 days. For employees out of the country for long periods or permanently, coverage needs to be arranged under an international policy. The extraterritorial issues arise because many states — Alabama, Alaska, California, Connecticut, Delaware, Georgia, Illinois, Indiana, Iowa, Kentucky, Maine, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, New York, North Carolina, Pennsylvania, Rhode Island, South Carolina, Tennessee and Wisconsin — permit concurrent jurisdiction between State and Longshore coverage. Some states — notably Florida, Louisiana, Maryland, Mississippi, New Jersey, Texas, Virginia and Washington —  do not permit this concurrent jurisdiction, and Longshore becomes the sole remedy. In concurrent jurisdictions, the employee can file in both state and federal court, and the employer must defend both. Summary
  • Recognize that having employees who work, live or are temporarily traveling to or through other states creates premium and coverage challenges for employers and agents.
  • Take time to understand the rules of the state where there is potential exposure.
  • States requiring coverage in 3.A. for some or all situations tend to be strict and impose severe penalties for non-compliance. Many carriers are often aware of the challenges these states present and will work with the agent/employer and add on an “if any” exposure basis.
  • Always attempt to secure the broadest coverage possible under the workers compensation policy, adding to 3.A. as many states with even minimal exposure. As a fallback, get the state in 3.C.
  • Obtain coverage for operations in monopolistic states separately.
  • Address out-of-state exposures when insured by a state-specific state fund or regional carrier that only writes in one or a few states. Remember, the 3.C. wording is designed to pay benefits — by reimbursing the employer — if the carrier cannot pay directly to the employee.
  • Check for employees traveling out of the country and arrange to expand coverage with the foreign endorsement or through an international policy.
  • Check with a marine expert to assess the exposure to the Longshore Act and whether coverage is required.  Longshore is very employee-friendly.
The white paper on which this article was based can be found here.

Maureen Gallagher

Profile picture for user MaureenGallagher

Maureen Gallagher

Maureen Gallagher is the Michigan managing director and national real estate and workers compensation brands leader in Neace Lukens. Gallagher previously held the position of president and CEO of Acordia of Michigan (Wells Fargo). Gallagher is on the national teaching faculty for the National Alliance for Insurance Education and Research.