Download

Cybersecurity: Five Tips on Disclosure Requirements

Failure to make adequate cybersecurity disclosures may subject a company to increased risk of enforcement actions and shareholder lawsuits.

With annual reporting season underway, C-suite executives wake to another day and another data breach. Target, Michael’s, Snapchat, Facebook, Twitter, Adobe -- the list goes on and on. By now, all companies should appreciate that, notwithstanding the most robust and sophisticated network security, any company is a vulnerable next “Target” for a serious cybersecurity incident. Consequences typically include negative publicity, reputational damage that hurts customer and investor confidence, lost market capitalization, claims and legal disputes, regulatory investigations -- and falling stock prices. In the wake of its high-profile data breach, Target’s directors and officers were hit on Jan. 29, 2014, with a shareholder derivative action alleging that “Target shares were trading above $63.50 on Dec. 18, 2013, before the news of the data breach and have fallen over 10.5% to $57.60” and that “Target … has suffered considerable damage from breach.”1

In view of the recent high-profile data breaches, and the pervasiveness of cybersecurity incidents in general, companies are well-advised to consider whether their current cybersecurity risk factor disclosures are adequate. Proper attention to cybersecurity risk factor disclosures may assist a company in avoiding a Securities and Exchange Commission (SEC) comment letter. Even more importantly, proper attention to cybersecurity risk factor disclosures may decrease the likelihood that a company will face securities class action litigation and shareholder derivative litigation in the wake of a cybersecurity incident that hurts the company’s stock price -- or, at a minimum, may mitigate a company’s potential exposure in the event of such litigation.

The Form 10-Ks that public companies are preparing to file in the coming weeks present a significant opportunity for companies to review and strengthen their cybersecurity risk factor disclosures. Below are five tips that companies may wish to consider in reviewing the adequacy of their existing cybersecurity disclosures:

SEC Disclosure Guidance

By way of background, companies must keep in mind that, although existing disclosure requirements do not (yet) expressly reference “cybersecurity,” the SEC’s Division of Corporation Finance (SEC staff) has emphasized the importance of appropriate cybersecurity disclosures. In the wake of what it termed “more frequent and severe cyber incidents,” the SEC issued cybersecurity disclosure guidance,2 which advises companies to review, on a continuing basis, the adequacy of their disclosure relating to cybersecurity risks and cyber incidents.3

While acknowledging that no existing disclosure requirement explicitly refers to cybersecurity risks and cyber incidents, the SEC’s guidance stresses that existing requirements oblige companies to make appropriate cybersecurity disclosures. 

SEC Chairwoman Mary Jo White reaffirmed a company’s current cybersecurity disclosure obligations in response to an April 9, 2013, letter received from Senate Commerce Chairman Jay Rockefeller.4 In his letter, Chairman Rockefeller urged the SEC to “elevate [its] guidance,” noting that “investors deserve to know whether companies are effectively addressing their cybersecurity risks.” In response, Chairwoman White emphasized that “[e]xisting disclosure requirements … impose an obligation on public companies to disclose risks and events that a reasonable investor would consider material” and that “cybersecurity risks are among the factors a public company would consider in evaluating its disclosure obligations.”5 Chairwoman White also highlighted that cybersecurity risk “is a very important issue that is of increasing concern” and stated that the SEC “continues both to prioritize this important matter in its review of public company disclosures and to issue comments concerning cybersecurity.”

In its guidance, the SEC staff advises companies to disclose cybersecurity risks consistent with the Regulation S-K Item 503(c) requirements for risk factor disclosures generally, such that the disclosure provided must adequately describe the nature of the material risks and specify how each risk affects the company. The guidance proceeds to advise that appropriate disclosures may include the following:

  • Discussion of aspects of the registrant’s business or operations that give rise to material cybersecurity risks and the potential costs and consequences;
  • To the extent the registrant outsources functions that have material cybersecurity risks, description of those functions and how the registrant addresses those risks;
  • Description of cyber incidents experienced by the registrant that are individually, or in the aggregate, material, including a description of the costs and other consequences;
  • Risks related to cyber incidents that may remain undetected for an extended period; and
  • Description of relevant insurance coverage.6

Although the guidance does not add cybersecurity disclosure obligations, it is abundantly clear that failure to make adequate cybersecurity disclosures may subject a company to increased risk of enforcement actions and shareholder suits in the wake of a cybersecurity incident that hurts a company’s stock price.

The Five Tips

The following five tips may assist companies in reviewing the adequacy of their existing cybersecurity disclosures based on the SEC’s disclosure guidance as well as comments issued to approximately 55 companies over the last two years.

1. Perform a cybersecurity risk asssessment. The SEC staff states in its guidance that it expects companies to evaluate their cybersecurity risks and take into account all available relevant information, including prior cyber incidents and the severity and frequency of those incidents as well as the adequacy of preventive actions taken to reduce cybersecurity risks in the context of the industry in which they operate and risks to that security, including threatened attacks of which they are aware. To facilitate adequate disclosures, companies should consider engaging in a thorough assessment concerning their current cybersecurity risk profile and the impact that a cybersecurity breach may have on the company’s business. In addition to positioning the company to provide adequate cybersecurity risk factor disclosures, the undertaking of a risk assessment is consistent with the National Institute of Standards and Technology’s recently released Preliminary Cybersecurity Framework.7 At a high level, it provides a framework for critical infrastructure organizations to achieve a grasp on their current cybersecurity risk profile and risk management practices and to identify gaps that should be addressed to progress toward a desired “target” state of cybersecurity risk management.8 Although the Cybersecurity Framework is voluntary, organizations are advised to keep in mind that creative class action plaintiffs (and even some regulators) may nevertheless assert that the Cybersecurity Framework provides a de facto standard for cybersecurity and risk management.

2. Consider disclosing prior -- and potential -- breaches. To the extent a company or one of its subsidiaries has suffered a reported or known cybersecurity event, the company should anticipate that the SEC may issue a comment letter if the event is not disclosed. The following comments are typical of what a company might expect to see: 

  • We note that [your subsidiary] announced on its website that a cyber attack occurred during which millions of user accounts were compromised. Please tell us what consideration you gave to including expanded disclosure consistent with the guidance provided by the Division of Corporation Finance's Disclosure Guidance Topic No. 2.
  • We have read several reports of various cyber attacks directed at the company. If, in fact, you have experienced cyber attacks, security breaches or other similar events in the past, please state that fact to provide the proper context for your risk-factor disclosure. 

​Notably, the guidance states that appropriate disclosures may include a description of cybersecurity incidents that are material individually or in the aggregate. And the comments issued to date indicate that where a company states that it has not been the victim of a material cybersecurity event, the SEC nonetheless has requested that the company’s risk-factor disclosure be expanded to state generally that the company has been the victim of hacking -- regardless of the fact that prior events were immaterial. A few of the SEC comments to date include (in summary form):

  • We note your response that the incident did not have a material impact on the company’s business. To place the risks described in this risk factor in appropriate context, in future filings please expand this risk factor to disclose that you have experienced cyber attacks and breaches.
  • You state that you have not experienced a material breach of cybersecurity. Your response does not appear to address whether you are experiencing any potential current business risks concerning cybersecurity. For example, despite the fact you believe you have not experienced a material breach of your cybersecurity, are you currently experiencing attacks or threats to your systems? If you have experienced attacks in the past, please expand your risk factor in the future to state that.
  • We note that your response suggests that you have, in fact, experienced third-party breaches of your computer systems that did not have a material adverse effect on the company’s operations. To place the risks described in your current risk factor in appropriate context, in future filings please expand your disclosure to state that you have experienced cyber attacks and breaches.

​In addition, the SEC’s guidance advises that companies may need to disclose known or threatened cyber incidents together with known and potential costs and other consequences. Companies in targeted industries that have not yet suffered a cybersecurity incident (or are not yet aware that they have suffered an incident) should consider disclosing how the company might be affected by a cybersecurity incident -- even if no specific threat has been made against the company. Below are sample summary comments received by companies based on their particular industry or peer disclosures:

  • We note press reports that hotels and resorts are increasingly becoming a target of cyber attacks. Please provide risk -actor disclosure describing the cybersecurity risks that you face. If you have experienced any cyber attacks in the past, please state that fact in the new risk factor to provide the proper context.
  • Given that other companies in your industry have actually encountered such risks from cyber attacks, such as attempts by third parties to gain access to your systems for purposes of acquiring your confidential information or intellectual property, including personally identifiable information that may be in your possession, or to interrupt your systems or otherwise try to cause harm to your business and operations and have disclosed that such risks may be material to their business and operations, please tell us what consideration you gave to including disclosure related to cybersecurity risks or cyber incidents.
  • We note that the incidences of cyber attacks, including upon financial institution or their service providers, have increased over the past year. In future filings, please provide risk-factor disclosure describing the cybersecurity risks that you face. In addition, please tell us whether you have experienced cyber attacks in the past. If so, please also disclose that you have experienced such cyber attacks to provide the proper context for your risk-factor disclosure.

3. Be specific. The SEC staff has advised that companies should avoid boilerplate language and vague statements of general applicability. In particular, the guidance states that companies should not present risks that could apply to any issuer or any offering and should avoid generic risk-factor disclosure. In addition, the guidance states that companies should provide disclosure tailored to their particular circumstances and avoid generic boilerplate disclosure. Companies that offer generally applicable statements may expect to receive comments such as the following:

  • You state that, “Like other companies, our information technology systems may be vulnerable to a variety of interruptions, as a result of updating our SAP platform or due to events beyond our control, including, but not limited to, natural disasters, terrorist attacks, telecommunications failures, computer viruses, hackers and other security issues.” Please tell us whether any such events relating to your cybersecurity have occurred in the past and, if so, whether disclosure of that fact would provide the proper context for your risk-factor disclosure.
  • We note that you disclose that you may be vulnerable to breaches, hacker attacks, unauthorized access and misuse, computer viruses and other cybersecurity risks and events. Please tell us whether you have experienced any breaches, hacker attacks, unauthorized access and misuse, computer viruses and other cybersecurity risks and events in the past and, if so, whether disclosure of that fact would provide the proper context for your risk-factor disclosures. 

​4. Remember that a vulnerability “road map” is not required. Although the SEC seeks disclosures that are sufficient to allow investors to appreciate the nature of the risks faced by a company, it has made clear that the SEC does not seek information that would create a road map or otherwise compromise a company’s cybersecurity. At the outset of its guidance, the SEC staff states that it is mindful of potential concerns that detailed disclosures could compromise cybersecurity efforts -- for example, by providing a “road map” for those who seek to infiltrate a company’s network security -- and that disclosures of that nature are not required under the federal securities laws. The SEC guidance later reiterates that the federal securities laws do not require disclosure that itself would compromise a company’s cybersecurity.

5. Consider insurance. Network security alone cannot entirely address the issue of cybersecurity risk; no firewall is unbreachable, and no security system is impenetrable. Insurance can play a vital role in a company’s overall strategy to address, mitigate and maximize protection against cybersecurity risk. Reflecting this reality, the SEC guidance advises that appropriate disclosures may include a description of relevant insurance coverage that a company has in place to cover cybersecurity risks. The SEC’s guidance provides another compelling reason for companies to carefully evaluate their current insurance program and consider purchasing cyber and data privacy-related insurance products, which can be extremely valuable.9 In the wake of a data breach such as at Target, for example, a solid cyber insurance policy may cover not only liability arising out of potential litigation, such as defense costs, settlements and judgments, but also breach-notification costs and other “crisis management” expenses, including forensic investigation, credit monitoring, call centers and public relations efforts, as well as potential regulatory investigations, fines and penalties. Recent SEC comments have requested information regarding both whether the company has obtained relevant insurance coverage as well as the amount of the company’s cyber liability insurance.

Considering these five tips may assist companies in minimalizing the likelihood of receiving an SEC comment letter (and possibly multiple rounds of comments) and, even more importantly, the likelihood of lawsuits alleging inadequate disclosure in the event of a cybersecurity incident.

1 Collier v. Steinhafel et al., No. 0:14-cv-00266 (D. Minn.) (filed Jan. 29, 2014), at ¶ 76.

2The guidance defines “cybersecurity” as “body of technologies, processes and practices designed to protect networks, systems, computers, programs and data from attack, damage or unauthorized access.”

3SEC Division of Corporation Finance, Cybersecurity, CF Disclosure Guidance: Topic No. 2 (Oct. 13, 2011), available at http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm

4The April 9, 2013 letter is available at http://www.commerce.senate.gov/public/?a=Files.Serve&File_id=49ac989b-bd16-4bbd-8d64-8c15ba0e4e51

5Chairman White’s May 1, 2013 letter is available at http://articles.law360.s3.amazonaws.com/0441000/441415/512013%20Letter%20from%20SEC%20Chair%20White. pdf

6While the majority of the guidance is focused on risk factors, the SEC also advises that cybersecurity disclosures may be appropriate in other areas of a company’s filings, including management’s discussion and analysis “if the costs or other consequences associated with one or more known incidents or the risk of potential incidents represent a material event, trend, or uncertainty that is reasonably likely to have a material effect on the registrant’s results of operations, liquidity, or financial condition or would cause reported financial information not to be necessarily indicative of future operating results or financial condition.”

7The Cybersecurity Framework, available at http://www.nist.gov/itl/upload/preliminary-cybersecurity-framework.pdf.

8Roberta D. Anderson, NIST Unveils Preliminary Cybersecurity Framework, Cybersecurity Alert (Nov. 25, 2013), available at http://www.klgates.com/nist-unveils-preliminary-cybersecurity-framework-11-22-2013/

9 Roberta D. Anderson, Before Becoming The Next Target: Recent Case Highlights The Need To Consider Insurance For Data Breaches, Insurance Coverage Alert (Jan. 16, 2014), available at http://www.klgates.com/before-becoming-the-next-target--recent-case-highlights-the-need-to-consider-insurance-for-data-breaches-01-16-2014/

Next Steps for Insurance Companies in the 'Sharing Economy' (Part 3 of 3)

Given the momentum behind the sharing economy, it may be time for insurers to take a closer look at this emerging market, especially for cars.

As of January 2013, there were 46 active car-sharing programs and over 1 million members in North America alone. Worldwide, car-sharing companies operate in more than 27 countries on five continents with more than 1.7 million members. Given the momentum behind the sharing economy, it may be time for insurers to take a closer look at this emerging market.

Insurers may have an opportunity to lead innovation in the sharing economy, particularly in the car-sharing market. In much the same way as they have provided sound leadership about innovations in the past, the decisions about whether and how to get involved in the sharing economy should start by looking at some basic questions.

What is the market opportunity?

What is the market size now, and what are the projections? The idea of car-sharing is gaining traction, and thus considerable study is being given to its potential. Insurers should ask themselves not only about market growth projections, but also about what portion of those revenues could belong to insurance.

What are the market needs?

Car-sharing companies and renters are reaching out to insurers to provide insight into their unique business models and risk needs. Take advantage of this opportunity to talk in depth with this potential new customer base, and explore different models and products that might meet their needs.

What types of data are needed for accurate risk assessment, and where can that data be obtained?

Car-sharing companies are already capturing information on their owners and drivers. Further, peer reviews are providing additional data not traditionally available to insurance companies. Work with these start-ups to determine what types of data are available, what needs to be captured and how that data can be collected and used.

How can this data be used to assess whether the car-sharing market aligns with your risk appetite?

Most insurance companies have a clearly defined and communicated risk appetite. By its very nature, the car-sharing market will not automatically fit into any pre-established category. By conducting a careful assessment of market potential and available data, insurance companies can determine if they want to explore this opportunity further.

Insurance companies have always been leaders in developing products and services that meet market needs. Today, with more advanced data-capturing mechanisms and predictive analytics, insurers understand each of their customers at a much more granular level. It’s time for insurance companies to apply this same expertise to the sharing economy. It’s time for them to determine if the opportunity is worth the risk.

Striking a Nerve: Google and Insurance

Google is bringing an outside-in, customer-driven approach that is causing insurers to rethink, reimagine and reinvent their visions of a technology-enabled future. 

To say we struck a nerve in the industry with the Google and Insurance: Far Reaching Implications research is an understatement! It was picked up by all the major industry media – in some cases multiple times. It has set a record for downloaded and purchased SMA research, generating a torrent of follow-up calls and discussions. It has been shared and used by executive teams for discussion and strategic planning. The companion blog for the research had nearly 10,000 views – and continues to be posted, tweeted and retweeted a month and half after it was published! 

So why has there been such a strong interest and reaction in the industry?

Well, one reason might be that there is a fascination and admiration for the competitive drive in Google’s transformation from a search engine to an innovator of technologies and solutions like Android, Google cars, Google glasses, wearable devices and others. And then there is the fact that Google is securing a strong, growing (and enviable) customer loyalty. Don’t overlook the challenge to other innovators like Apple, Amazon and Microsoft – it’s impossible to ignore, just like Google's impressive growth and financial results! But the appeal that underpins all of this is Google’s unwavering vision of making information universally accessible and useful. Having a huge imagination that is spearheading innovation in multidimensional ways doesn’t hurt either! 

As Google drives innovation, offering an integrated and seamless customer experience and making available the use of its ground-breaking technologies to people in their everyday lives, the levels of customer intimacy and loyalty continue to increase. In the opposite direction, the vast amount of data becoming available via some of these technologies concerning individuals and their cars, homes and bodies is breath-taking. The change will be transformative! 

This is why the implications for insurance are so great. Google is bringing an outside-in, customer-driven approach to innovation that is causing insurers to rethink, reimagine and reinvent their visions of a technology-enabled future. Google is organizing data, technology and location around people, creating a level of customer empowerment and -centricity unheralded in any industry, let alone insurance. Not only is this powerful, it is fundamentally changing the business of insurance!   

Innovation is no longer just a nice-to-have initiative. It has become a must-have, strategic, core mandate that will define a new era of winners (and losers). Why? Because the increasingly rapid pace of change is challenging decades of business traditions and assumptions and demanding a response. This is unprecedented in the history of the insurance industry. All the while, the changes just keep coming: new technologies, the mash-up of technologies and new uses for these technologies.

These changes are highly disruptive, but they are also transformational. One industry innovation leader whom we recently spoke to about innovation noted that: “There is an outrageous level of individualism – from devices, data and components that will break the traditional infrastructure, culture and systems of traditional insurers.” Companies like Google, Apple, Uber, Zipcar and others, as well as next-gen and emerging technologies, are intensifying this level of individualism. 

Many insurers, large and small, are struggling to get their heads around a comprehensive view or a full understanding of the impact that these influencers will have on the disruption and transformation of the insurance industry. That is why the Google and Insurance research report has provoked such a response in the industry – because it provides insights and a glimpse of the challenges and opportunities for the industry. It also points to why, as an industry, we need to rethink how we respond to and embrace innovation as the core of a new culture and keystone of a new future. 

Other industries, from retail to books, music and movies, have experienced the same thing the insurance industry is now encountering: the very foundations of their businesses are being challenged, requiring novel thinking, experimentation, innovation and adoption of the new and emerging technologies. As one industry leader and CIO recently commented, “Insurers must build knowledge, a network and an ecosystem of outside-in relationships to reimagine and contribute to their company’s future.”

This persistent and continual disruption will necessitate a new way of embracing change and innovation. It will require a culture and model built around continuing collaboration and ideation that extends outside the traditional insurance organization. This is why an innovation mandate is critical.  

The innovation mandate must track and assess trends and influencers both inside and outside the industry, prepare plans and scenarios, experiment and collaborate to gain competitive advantage. Unfortunately, the day-to-day operational demands, time constraints and shortage of expertise or resources for evaluating the many implications for insurance will find most insurers unprepared or unequipped to respond to this level of disruption. More troubling is the way that many insurers are continuing to operate with the long-standing approach of wait-and-see or being a fast follower. With the accelerating release of next-gen technologies, eager competitors, new influencers and increasing customer demands, failing to adopt a culture of innovation and collaboration could create a potentially unsurmountable risk to survival of the business.

For insurers, the coming years promise unparalleled opportunity to increase their value to their customers. Those that are best able to capitalize on the key technology influencers will reap the most in rewards. In contrast, those that do not prepare for the future will find themselves falling behind, losing both competitive position and financial stability. To capture the full potential, insurers must determine to create and participate in an ecosystem of outside experts and resources; inspire their leadership; and enable their journey of change, transformation and innovation. Why will this be so important? Because the ecosystem will integrate new ideas and thinking from outside the organization, and provide that outside-in perspective needed to break legacy assumptions.  

The innovation journey toward rethinking, reimagining and reinventing the business of insurance has started. Strategy Meets Action has joined the journey. Have you?

Dare to Be Different: New Ways to Communicate With Customers

Here is a blueprint for how insurers can go from communications with customers focused on regulated activities to ones that deliver real ROI.|

||
Two insurance industry surveys for 2014, released by J.D. Powers (Auto Purchase and Property Claims), conclude that timely and relevant communication is the dominant factor in customer satisfaction. The studies show the intrinsic value of communication in building trust with customers, resulting in retention and in growth.Roughly 45% of insurers cited customer-experience levers as top business goals in research on customer communication released by Forrester in November 2012. So we would expect insurers to tap into the opportunity to engage customers in ways that drive renewals, deepening relationships and brand affinity. Obvious, right?The reality is a far cry from this.Instead, insurers have been focusing on the very obvious savings from the reduced need to print and mail the communication documents, by pushing the customers to digital channels.Here comes the second paradox.You would hope that customers are now far more engaged through the digital platform. But a survey conducted by Nationwide Insurance reveals that 60% of customers have not read their policy in full in a year, and only one in five customers believed that they completely understood their policy. The top two reasons cited are that documents are too long and too complicated. The Consumer Bill of Rights in Texas is nine pages long -- even those who receive it won't read the full document. For most, buying insurance is like buying a car without knowing if it will accommodate your two wonderful kids, wife, the bags from your normal shopping trips and a stroller. Nearly 85% of communications with a customer after a sale are in categories covered by regulation: contracts, endorsements, notices, amendments, bills and statements, notifications, follow up notices, reminders, etc. According to the Forrester study, two out of three insurers are worried about avoiding noncompliance rather than focusing on communications that can deliver far more measurable returns from better customer engagement. Meanwhile, more than half of customers who file a claim don’t understand how to do so and can have a bad and emotional experience, while those who don't file a claim are never given a way to visualize the protection they enjoy. Are insurers too focused on regulatory issues and not engaged enough with the customers whose hard-earned money they hope to keep receiving? Can insurers build trust with customers and sell more and faster? Our research suggests that some insurers have taken the lead and have implemented communication capabilities that are delivering benefits in silos. But the industry as a whole has not yet unlocked the value of service communication to generate lower-cost relationships and build trust faster, replacing expensive strategies led by marketing. We believe the starting point is to have a good understanding of contact strategy and its nuances, mapped to what customer value at different stages. Here is what insurers can do to go from Regulation to ROI.
  • Produce a blueprint of customer communication touch-points across the product lifecycle. The important factors are: business process, event, frequency, emotion, customer segment, channel and interaction sequence. It's crucial to define the right performance indicators and establish a tracking mechanism. The blueprint will unlock the value of relationship through continuous engagement. Today, communications operations mainly take a “stay out of jail” approach.
  • Make communication proactive, not reactive. Several surveys show that timely communication can limit escalation to 6% of customer issues, whereas delays and unclear communications increase complains by as much as a factor of three. Billing presents the best opportunity to engage customers, through snippets of communication before and after the billing transaction. The same approach can be used to prepare customers for changes in premiums, rather than going through several painful calls around renewals that erode trust. For example, Allstate communicates “reason for premium change,” which reduced the call volume and cost of contact drastically.
  • Make a meaningful channel shift -- Of the increasing number of customers who own a smartphone, 90% want the option of buying and obtaining service through mobile apps. The importance of mobile is demonstrated by the fact that 95% of text messages are opened within seven minutes of being received; insurers should look into using push notification through this low-cost channel. To avoid customer pushback about SMS cost, insurers should look for free-to-end-user (FTEU) SMS, which is cheaper than print-and-mail. An integrated communication center should be developed that spans across digital channels and other communication options, including paper. Investigate the possibilities of social media. Include capabilities for e-signatures.
  • Provide a digital policy with intuitive drilldown into all features. Mobile policy download, catastrophe alerts, billing alerts, claims alerts, mobile ID cards and a digital locker all drive up channel adoption and communication effectiveness, and there is opportunity to go much further in treating a policy as a mobile app.
  • Produce creative content. AT&T's smart video bill directly addresses the population that wants information on-the-go. Smart video is customized for individual customers and helps in visualization of benefits. Allstate’s "Mayhem" advertisement provides this sort of visualization, albeit from a marketing perspective. The same investment can easily be used to address the accessibility requirements for ADA (Americans with Disability Act). GEICO’s coverage coach is an animated tool used for educating the customers as to what coverage can be right for them. Imagine if this visual approach was applied to claims, at the filing stage; it would help customers understand their coverage and reduce complaints. Progressive, GEICO and USAA send periodic news through print and emails that are relevant to the season; for example, something explaining ways to protect a boat or motorcycle during winter. This communication improves customer engagement across the life cycle.
  • Leverage emerging approaches, such as in-car-entertainment, wearable media and the "connected home." Gamification -- using techniques like those for Angry Birds, rather than like a traditional insurance policy -- is another emerging approach that can be used. The customer can also be provided virtual assistance to simulate an accident scene, which will help with an assessment while greatly reducing fraud. Gamification should be used to provide customers a visualization of the claims process and the roles they play, which will improve the experience and increase retention.
  • Understand the customers better – Most insurers deliver marketing messages often but do not see a corresponding lift in their results. This is simply because they aren’t taking advantage of today's data and analytic technology to understand customers as well as they could and to deliver more-individualized, relevant messages. Effective use of all available information about the customer is the cornerstone of this approach. Retailers tend to lead the pack here; insurers can learn from them. Try to sell when the customer is happy; if he is not happy, then create happiness in him and sell. This approach has delivered proven results.
With evolving customer needs and emerging channel and content technologies, insurers have a great opportunity to improve their communication to build trust with their customers, deliver much better returns on their sales efforts and contain most preventable costs, while providing an experience that customers value. Are you up for the challenge?

Nikhil Datar

Profile picture for user NikhilDatar

Nikhil Datar

Nikhil Datar is a customer experience improvement leader helping companies that want to put the customer at the center of their business model. He is a founding member of CXPA. He has led multiple customer experience transformation services and solutions that delivered direct business benefits.

Sathyanarayanan Sethuraman

Profile picture for user SathyanarayananSethuraman

Sathyanarayanan Sethuraman

Sathya Sethuraman is an insurance industry strategist and thought leader with over 20 years of experience. He is a trusted advisor to Fortune 100 global insurance and financial services enterprises and has led large-scale digital transformation initiatives.

Biometrics and Fraud Prevention: Seeing Eye to Eye

Many healthcare insurers are using biometrics to help reduce billing fraud by eliminating the sharing of medical insurance cards between patients.

As more consumers opt for the flexibility of serving themselves, it has become essential for businesses to deploy strong systems to authenticate identity. The challenge is how to reduce fraud without frustrating consumers or compromising the customer experience.

Biometric technology has been seen increasingly as a solution in industries such as financial services, but is there a useful place in insurance? As technology becomes more convenient --and more secure -- many are saying yes.

What’s What in Biometrics

By identifying individuals through their unique physiological or behavioral patterns, biometrics offers a higher level of security, ensuring that only authorized persons have access to sensitive data. Physiological biometrics include fingerprint, face, iris and hand geometry recognition. Behavioral biometrics identify signature and voice verification, including keystroke kinetics that identify a person’s typing habits.

As consumer-centric channels such as mobile and online applications continue to expand, so will the risk of fraud. And while many industries, including insurance, continue to deploy new technologies to stave off attacks, the reality is that the tools and methods by which professional fraudsters operate are becoming increasingly sophisticated.

“While insurers have applied some preventive measures against fraud, the industry as a whole needs to catch up,” says Steve Cook, director of business development, Facebanx. “They must be forward-thinking and recognize the benefits of biometric technology and how it can help in preventing fraudulent activities.”

Reducing Claim Fraud and Protecting Data

One area where biometrics has begun to take hold is healthcare insurance. A study by the Ponemon Institute found nearly 1.5 million Americans to be victims of medical identity theft. Healthcare fraud is estimated to cost between $70 billion and $255 billion a year, accounting for as much as 10% of total U.S. healthcare costs.

Many insurers are using biometrics to help reduce billing fraud by eliminating the sharing of medical insurance cards between patients, or by making it more difficult for a person to assume another’s identity. For example, as an alternative to paper insurance cards, a biometric iris scan can immediately transport proof of a patient’s physical presence at a healthcare facility.

Biometric technology is also assisting healthcare insurers with compliance and data integrity standards — in particular with those set by the Health Insurance Portability and Accountability Act (HIPAA). For example, in addition to adhering to requirements for automatic logoff and user identification, insurers must implement additional safeguards that include PINs, passwords and some method of biometrics.

Fraud Capabilities in Property and Casualty

According to a report by Aite Group, the war against fraud in property and casualty insurance is also escalating. The group estimates that claim fraud in the U.S. P&C industry alone cost carriers $64 billion in 2012 and will reach $80 billion by 2015. Customer contact centers have been hit particularly hard. While the focus on protecting consumer data has primarily centered on online channels, fraudsters are now targeting the phone channel, as well. Leveraging information obtained through social media networks, thieves are manipulating call center representatives and gathering customer information. 

For this reason, biometrics are being deployed. Representatives can cross-reference incoming calls against a watch list of known fraudsters, identifying unique voice prints. Advanced biometric techniques can also identify fraud patterns based on speech analytics, talk patterns and various “red flag” interactions.

Summary

The insurance industry is just beginning to scratch the surface when it comes to identifying areas of fraud management to which biometric science can be applied. 

“Insurance companies [that] are first to adopt this kind of technology will push the fraudsters over to the competition, because fraudsters don’t want their face or voice on a database that they can’t control,” Cook says.

Making the switch to biometric security measures can mean a substantial investment if done on a large scale. Even so, with the proliferation of online channels, consumer conveniences and ever-shifting tactics of fraudsters, deploying some degree of biometric technology will become a competitive necessity. And, as long as the insurance industry continues to expand consumer services because of e-commerce and m-commerce, no doubt new applications of biometrics will come about.

Winning the War Against Opioid Addiction and Abuse

We have come a long way in the battle against opioid addiction in a relatively short time, and a better long-term solution could be just around the corner.|

As we move forward with winning the war against opioid addiction, it can sometimes be challenging to read the daily headlines and stay positive, especially around the holidays. A December article titled "Drug Abusers May be Injuring Pets to Get Pain Killers" shared how police officers and community leaders informed the Ohio attorney general’s office that people have been abusing drugs rightfully prescribed to pets. The US News HealthDay story titled "Secure Your Prescription Drugs When Hosting Holiday Parties" warned readers about the importance of securing prescription drugs in a safe location before guests arrive. When stories deteriorate to addicts intentionally harming their dogs and to people worrying about holiday guests raiding medicine cabinets, rock bottom isn’t far away. However, 2013 positioned us well for achieving improved results during 2014. Some of last year’s positive developments include:

1.   State law changes establishing clearer standards of care, reporting and tracking of controlled narcotics, bans on abused narcotics, etc.

2.   State and federal agencies aggressively prosecuting individuals who prescribe opioids illegally or  operate “pill mills,” revoking registrations of some pharmacies and compelling healthcare providers and pharmacies to surrender or forfeit their medical licenses to state medical/pharmacy boards

3.   Physician-led education efforts like the Physicians for Responsible Opioid Prescribing

4.   Medical boards actively addressing the inappropriate and illegal dispensing of drugs

5.   Heightened awareness of the neonatal abstinence syndrome crisis in the U.S.

6.   Workers' compensation insurers leveraging advanced analytics, physician education efforts, evidence-based pain diagnoses and utilization reviews to reduce injured worker reliance on addictive prescription drugs

7.   The Food and Drug Administration’s Risk Evaluation and Mitigation Strategy

8.   The issuance of the October 2013 Trust for America’s Health report titled “Prescription Drug Abuse: Strategies to Stop the Epidemic”

9.   Continuing prosecution and sentencing of healthcare providers

10. Efforts by national medical organizations

The first eight developments were addressed in the authors’ first quarter 2013 Physician Insurer magazine article titled "The Opioid Abuse Epidemic, Turning the Tide" and our Dec. 2, 2013 Property Casualty 360 Claims Magazine article titled "10 Strategies to Combat the Rx Abuse Epidemic – An Insurers Perspective." This article will expand on the last two developments and share some thoughts on what may be in our future when it comes to winning the war on opioid addiction and abuse. Prosecution and sentencing of healthcare providers 2013 was marked by the successful prosecution and sentencing of healthcare professionals involved in various forms of prescription drug diversion. Arguably the most notable of these was the 39-year prison sentence given to David Kwiatkowski, the former New Hampshire hospital technician who caused dozens of people to become infected with hepatitis C when he injected himself with pain killers using syringes that were then used on patients. Kwiatkowski admitted in August to stealing the drugs and leaving used syringes for hospital use for years, despite knowing he was infected with hepatitis C. His case drew national attention to the problem of prescription drug diversion among healthcare workers; caused a number of institutions to finally take a fresh look at their human resource policies and systems being used to detect diversion; and, has, we hope, sent a strong message of deterrence to all healthcare drug diverters -- it is only a matter of time before you get caught! Efforts by national medical organizations (NMOs) On an extremely positive note, we are beginning to see NMOs join the fight to help stem the opioid epidemic. On Dec. 10, 2013, the American College of Physicians released a position paper titled "Prescription Drug Abuse: A Policy Position Paper From the American College of Physicians." The goal of the paper was to provide physicians and policy-makers with 10 recommendations to address the significant human and financial costs related to prescription drug abuse. The recommendations include support for additional education, a national prescription drug monitoring program, establishment of evidence-based nonbinding guidelines regarding recommended maximum dosage and duration of therapy, consideration of patient-provider treatment agreements and the passage of legislation by all 50 states permitting electronic prescription for controlled substances. In turn, in January 2014, the American Academy of Pediatrics (AAP) Committee on Drugs and Section on Anesthesiology and Pain Medicine issued a report titled "Recognition and Management of Iatrogenically Induced Opioid Dependence and Withdrawal in Children." The clinical report recommended guidelines for prescribers to follow when weaning children from opioids. As noted by lead author Jeffrey Galinkin, MD, "[t]he key reason the AAP was keen to publish this paper and go forward with this guideline is that people are unaware that patients can get drug-specific withdrawal symptoms from opioids as early as five days to a week after having been on an opioid chronically." This recommendation was immediately followed by the Centers for Medicare and Medicaid Services (CMS) Jan. 10, 2014, Federal Register Volume 79, Number 7 publication of proposed rules revising the Medicare Advantage (MA) regulations and prescription drug benefit program (Part D) regulations to help combat fraud and abuse in these programs. The proposed rules include requiring prescribers of Part D drugs to enroll in Medicare, a feature that CMS believes will help ensure that Part D drugs are prescribed only by qualified individuals. As reported by Medscape Medical News, CMS is also seeking the authority to revoke a physician's or eligible professional's Medicare enrollment if:

• CMS determines that he or she has a pattern or practice of prescribing Part D drugs that is abusive and represents a threat to the health and safety of Medicare beneficiaries or otherwise fails to meet Medicare requirements; or

• His or her Drug Enforcement Administration certificate of registration is suspended or revoked; or

• The applicable licensing or administrative body for any state in which a physician or eligible professional practices has suspended or revoked the physician or eligible professional's ability to prescribe drugs.

Furthermore, CMS proposes employing data analysis to identify prescribers and pharmacies that may be engaged in fraudulent or abusive activities. In Table 14 of Federal Register Volume 79, Number 7, CMS’ Office of the Actuary estimates the savings to the federal government from implementing its proposed provisions will be $83 million in calendar year 2015, $132 million in 2016, $171 million in 2017, $364 million in 2018 and $589 million in 2019. Source: CMS Innovation in our future In addition to the above efforts, companies continue to innovate and research new ways to address historical challenges. Vatex Explorations is building a real-time individual-dose monitoring system called Divert-X to reduce drug trafficking, misuse and addictions that result from routine medical care. Divert-X monitors a patient’s individual doses through the electronic transmission of data identifying the time of dose access, location and other measures. The analysis of the data in real time helps physicians and pharmacists identify drug-taking behaviors that fall outside of norms, allowing early intervention before misuse or addiction set in. In 2012, the Food and Drug Administration approved an ingestible sensor that can be used to track real time data about your pill consumptions habits. The sensor, developed by Proteus Digital Health, was first approved for use in Europe before coming to the U.S. The ingestible sensor is part of the digital health feedback system, which includes a wearable sensor and secure app and is largely focused on serving the transplant population and patients with chronic illnesses. The authors could envision a day when the system could help in the battle against opioid addiction. Insurance companies are doing a better job of leveraging advanced analytics to understand their opioid-exposed population and the prescribing habits of the physicians treating their injured workers. Through the review of medical bills (e.g., date and types of service and payment, ICD-9 diagnosis codes, CPT-4 procedure codes, etc.) and pharmacy data (e.g., bill frequency,  aggressive refills, NDC drug codes, quantity used, generic vs. brand, supply days, use of prescriber, pharmacy name, etc.), insurance companies can identify usage and treatment patterns that fall outside of expectations using cluster analyses, association rules, anomaly detection and network “link” analyses. Law enforcement continues to push the envelope in finding innovative ways to combat drug diversion. Take, for example, the strategy developed in consultation with the National Association of Drug Diversion Investigators and Oklahoma Bureau of Narcotics to curb false reporting of the loss or theft of prescription drugs in Stillwater. According to a police spokesman, most physicians in Stillwater require patients to obtain a police report before they will write a replacement prescription for lost or stolen medications. This requirement resulted in an increase in the number of police reports filed, but a new problem emerged. How could anyone determine whether those police reports were legitimate? In response, the Stillwater police department created a database to record the names of any individual who reported the loss or theft of a prescription drug. The department now requires the individual to take a polygraph test before it will accept any subsequent report of a lost or stolen prescription drug. Fail that polygraph, and criminal prosecution may follow. Query: If this strategy were employed nationwide, would the medicine cabinet at home be guarded more closely? Conclusion There is no doubt we have come a long way in the battle against opioid addiction in a relatively short time. Although there is a lot of road left to travel, 2014 is well-positioned to carry forward the effective efforts from last year. Given the innovative spirit of the U.S. and passion of everyone involved in winning this fight, a better long-term solution could be just around the corner.

Kevin Bingham

Profile picture for user KevinBingham

Kevin Bingham

Kevin Bingham, ACAS, CSPA, MAAA, is the chief results officer of subsidiary initiatives at Chesapeake Employers’ Insurance. He has over 27 years of industry experience, including 21 years of consulting.

Healthcare Reform's Effects on Workers’ Compensation

While effects will be uncertain until the ACA has been fully implemented, employers can take steps now to lessen any negative impacts and increase the value of the positives.|

Since its passage in 2010, the Affordable Care Act (ACA) — commonly referred to as healthcare reform — has been the subject of intense political debate and a source of anxiety for many employers. Although most employers have focused on the law’s health benefit requirements, the ACA is also expected to affect how they manage their workers’ compensation costs. Employers should understand how reform will affect the quality of care available to their employees, the calculation of workers’ compensation premiums and claims filings — and what employers can do to manage those effects. Workers' Health Proponents of the ACA say it will lead to a healthier society. Because more people will have access to healthcare, advocates say, there will be a reduction in comorbidities — additional diseases or disorders that individual patients often have along with a primary disease or conditions. For example, diabetes and hypertension are typical comorbid conditions of obesity. These comorbidities can frequently complicate workers’ compensation claims. Consider that a California Workers’ Compensation Institute analysis of claims from 2005 to 2010 found that average benefit payments on claims for employees with obesity as a comorbidity were 81% higher than those without. There is, however, no significant evidence to support the contention that an employee is less likely to file a workers’ compensation claim simply because the employee is insured. For example:
  • A recent Assured Research study examining health insurance penetration rates and workers’ compensation loss ratios in individual states from 1999 to 2011 showed little correlation between the two measures.
  • Data from the Centers for Disease Control and Prevention indicate that heart disease remains the leading cause of death in the U.S. and that the percentage of Americans with a high body mass index has steadily climbed over the last 50 years — two trends that are not confined to the uninsured population.
Cost Shifting Employers have long been concerned that injuries from non-work-related causes will be shifted to workers’ compensation. Doing so is tempting because of workers’ compensation’s combination of higher reimbursement rates for medical providers and lack of deductibles and copayments for employees. There is significant evidence to show that treatment for the same diagnosis costs more under workers’ compensation than under group health insurance because of higher reimbursement rates and greater utilization of services. A recent Workers’ Compensation Research Institute study of 16 large states, for example, showed that workers’ compensation payments for shoulder surgeries were often significantly higher than group health medical payments for the same procedure. Some have speculated that the greater access to health insurance promised by the ACA will reduce this shift to workers’ compensation. However, it has become clear that the law will not result in all Americans having health insurance coverage. With the ACA requiring that employers offer coverage to all employees working 30 or more hours per week starting in 2015, one in 10 large companies are planning to cut back on hours for at least a portion of their workforce, according to Mercer’s National Survey of Employer-Sponsored Health Plans 2013. Other employers are using higher copayments and deductibles to help offset cost increases. It appears, therefore, that the financial incentive for employees to shift treatment toward workers’ compensation will continue under the ACA. Access to Care Probably the most predictable outcome of the ACA is that it will increase the number of individuals in the U.S. with health insurance coverage. Despite the potential benefits, this could put additional stress on a health are system that is already short on doctors. Among the 34 member nations of the Organisation for Economic Co-Operation and Development, the U.S. ranks 27th in physicians per capita (see Figure 1). And this problem does not appear to be going away: The Association of American Medical Colleges forecasts that physician demand will dramatically outpace supply over the next decade, leading to a shortage of more than 90,000 physicians in the U.S. in 2020. This is particularly troubling as it relates to specialists — for example, orthopedic surgeons — and the potential for delays in obtaining diagnostic tests and scheduling elective surgeries and other procedures. Longer periods of disability and complications as a result of such delays would ultimately drive workers’ compensation costs up. With this added pressure on a limited number of medical providers, it becomes more important than ever for employers to develop medical networks that focus on quality of care and outcomes — even if it means paying more on a fee-for-service basis. Employers that pay their medical providers fairly and quickly will have more timely access for their injured workers and should ultimately have lower workers’ compensation costs. Standards of Care Traditionally, the healthcare industry’s focus has been on volume; more patient admissions, tests and procedures translated to higher revenues. Post-reform, however, the industry has shifted its focus to improving standards of care and achieving better patient outcomes. If this transition results in less emphasis on costly procedures, which often produce questionable results, workers’ compensation costs could be reduced. Although it remains to be seen whether the standards of care developed under the ACA for group healthcare would be enforced under workers’ compensation, this is a promising development for employers. Premium Refunds The ACA provides for insurers to rebate premiums to employers that have better than expected performance with their healthcare programs. Employers can either refund such premiums back to their workers or use them to offset future premiums. The National Council on Compensation Insurance (NCCI) has indicated that if premium refunds are given to employees, this would be considered payroll under workers’ compensation premium calculations. In other words, having a good performance on its group health program could increase an employer’s workers’ compensation program costs because premium calculations are tied to payroll. Employers should keep this in mind when deciding what to do with healthcare premium rebates that may be received. Managing the Effects of Healthcare Reform There is little doubt that healthcare reform will have an impact on workers’ compensation costs and claim trends. And while the extent will not be known until the ACA has been fully implemented, employers can take steps now to lessen any potential negative impacts, and increase the value of the positives. For example, employers should:
  • Increase efforts to identify medical providers that can provide the best quality care for injured workers and take the necessary steps to ensure the workforce has access to these providers.
  • Carefully manage the approach to healthcare premium rebates, which could affect how payroll is calculated under workers’ compensation.
  • Closely monitor any shifts in injury claims to workers’ compensation. Despite the ACA’s promise of greater access to health insurance coverage, there remains a financial incentive for employees to seek treatment under workers’ compensation rather than group health.
  • Remain committed to loss-control efforts. Don’t let concerns over the ACA cause a loss of focus on this key area.

Five Workers’ Compensation Myths

It doesn’t surprise me that many employees believe that merely feeling pain at work makes for a compensable claim. What is surprising is how many business owners believe this same myth.

Travelers Insurance, which recently passed Liberty Mutual to be the largest workers' compensation insurance carrier in the U.S., published a list of five common workers' comp myths, from a small employer's perspective:

  1. “I only have a few employees, so I don’t need comp insurance.”
  2. “My employees won’t sue me.”
  3. “Comp insurance is too expensive, so I’ll just pay out of my pocket if an injury occurs.”
  4. “I provide a safe workplace, so my employees won’t get injured.”
  5. “Medical costs in the workers' comp system are just too high.”

While these myths are prevalent, I often see an additional five beliefs from my perspective as a workers' comp defense attorney that are as mythical as a mermaid:

1. Every injured worker needs an attorney.

While it is true that many injured workers do need to hire an attorney, there is certainly no need for most to obtain counsel. Most states have systems to resolve the claim directly with the injured worker without the time and expense associated with the claimant's hiring an attorney and filing a formal claim.

The complaint against injured workers representing themselves is what gave rise to that old joke: "A person who acts as his own attorney has a fool for a client.” I agree that most claimants don’t know as much comp law as does the average claimant’s attorney. That shouldn’t come as a shock to anyone.  But that doesn’t mean every injured worker needs an attorney. 

Most comp claims are compensable, so the only issue is the nature and extent of impairment. 

Is the final settlement for an unrepresented claimant always the same as for those who retained counsel? Obviously not, but that doesn’t mean the claimant gets less money. Remember that, in most jurisdictions, the claimant’s attorneys take between 20% and 33% of the final settlement as a fee. Add in a few thousand dollars for an IME report and discovery costs, and you can see how the fees and expenses go up faster than the winnings on Wheel of Fortune. If the claimant resolves the permanent partial disability portion of the claim on his own, he can still take home roughly the same amount as if he had retained counsel and paid fees and expenses out of a larger final settlement.

There is also the time value of money to consider.Claims where the injured worker is represented often take years to resolve, not weeks or months. Which is better to receive: $10,000 today or $12,000 three years from now? Most people would chose the former, and injured workers who don't hire an attorney are virtually guaranteed to get their money faster than if they retain counsel.

2. Injured workers are entitled to compensation for any painful condition that arises during working hours.

While this may be somewhat true in a few states (New York, California, Illinois), in most states this is simply false.

There are various philosophical theories that underlie the workers compensation statutes of a particular state, such as the “positional risk doctrine,” the “mutual benefit doctrine” and the “scope and course of employment” doctrine. Nevertheless, in most states there must be some connection between the injury and the employment for a claim to be compensable. Merely feeling pain at work is not enough.

It doesn’t surprise me that many claimants believe otherwise. What is surprising is how many small business owners believe this same myth.

I often talk to business owners who tell me stories that generally follow this path: “My employee says his arm hurts, and he wants me to take care of it. That’s all I know.” One doesn’t have to be that sunglasses-wearing guy from CSI: Miami to ask a few questions of the claimant, such as, “How did you hurt your arm?”; “Did the pain start while you were doing something in particular?”; or “When exactly did the pain start?”

3. The jurisdiction for a comp claim is where the carrier wants it to be.

This is a myth that is pervasive among adjusters and safety directors.

If employee works in State A but is in State B for a work-related purpose and is injured in State B, which state has jurisdiction over the claim? In most instances, the employee can choose to file his claim in either State A or State B, or even both! Yet, I have a conversation almost weekly with claims professionals who tell me: "Brad, I want this claim to be in State A, so please have the claim dismissed from State B."

If a state says it has jurisdiction over a claim, the basis for asking for a dismissal cannot be: “Judge, my adjuster simply doesn’t want the claim to be here.” I would obviously have a more reasoned position upon which to base my request, but the result is often the same: The judge denies the request.

4.  Employers have workers' comp insurance so they can let the carrier worry about their claims.

This is basically the same as believing that if I stick my head in the sand bad things can’t happen to me. Employers should manage and monitor comp claims as if the money being paid to the claimant is their own money. Wanna know why? BECAUSE IT IS THEIR MONEY!

Comp insurance works just like automobile insurance -- more claims always equates to increased premiums. Sure, an employer may have one or two claims that won’t affect premiums. However, with the cavalier attitude toward claims that underlies this myth, it’s only a matter of time before the premiums get higher than a surfer locked in a medical marijuana facility. 

5.  Most workers comp claims are fraudulent.

For claims professionals who handle comp claims on a daily basis, it often seems as if most comp claims are fraudulent. However, statistics simply don’t support this conclusion. A recent study from the University of Michigan concluded that only 2% of claims are fraudulent. I would think that the actual number is a bit higher than 2%, but certainly a far cry from 100%.

The danger in believing that most claims are fraudulent is that employers and carriers can face steep penalties for failing to provide legally required comp benefits in the absence of a valid reason to deny the claim. Additionally, employers and carriers that develop a reputation for denying claims without a valid reason often face higher awards from judges and arbitrators.

I like the approach used during the missile reduction talks with the Soviet Union during the 1980s: “Trust, but verify.” If we treat most claims as compensable while always being on the lookout for evidence of fraud, it creates opportunities to prevail at trial rather than opportunities to reinforce an employer stereotype as one that denies all claims.

The Truth About Treating Low Back Pain

There is overwhelming medical evidence that many diagnostic tests, treatments and surgeries for low back pain are ineffective and waste many billions of dollars a year in the U.S. alone.|

There is overwhelming medical evidence that many diagnostic tests, treatments and surgeries for low back pain are ineffective and waste many billions of dollars a year in the U.S. alone. Yet treatment appears not only to be continuing but seems to be growing and becoming more aggressive. The aggressive treatment of low back pain has become epidemic.

Medical studies on the problem of low back pain were widely reported in the mainstream media in 2007 and 2008. The Wall Street Journal, New York Times and other national publications like Time magazine reported on the Journal of the American Medical Association (JAMA) study that said Americans, "were spending more money than ever to treat spine problems, but their backs were not getting any better."

The study documented common mistakes doctors make when treating back pain, including:

  • Ordering excessive X-rays , MRIs and CT scans
  • Performing invasive surgery too soon
  • Failing to educate patients about surgical alternatives
  • Failing to address underlying mental health issues

Also released in 2007 was The State of Health Care Quality report published by the National Committee for Quality Assurance (NCQA). It stated, "back injuries often undergo aggressive treatment when less costly and less complicated therapy may yield similar or better results."

The NCQA report said that the vast majority of patients with low back pain have no identifiable cause of their symptoms and that less than 1% of X-rays provide useful information regarding the diagnosis of low back pain. Similarly, MRI and CT scanning usually fail to shed light on the causes of low back pain, except when there are red flags such as trauma or indicators for specific diseases. The authors stated that, "Needless tests and procedures that provide no real benefit to the patient can't do anything but harm."

The JAMA study also noted the widespread use of needless testing and found that 25% of the patients covered by private health insurance had an inappropriate imaging study, costing, in the aggregate, billions of dollars each year.

There is a wealth of medical evidence that most back and neck pain should be treated sparingly. An editorial in Spine Journal suggested that more than 200 treatments for chronic back pain are currently available in the clinical marketplace and that many of those "do not have a definitive track record in scientific studies."

The authors of the JAMA study concluded: "If we keep our diagnostic and treatment efforts within well-proven limits, and emphasize the importance of activity and self-care, we suspect we would see better outcomes."

Yet the total number of some spine treatments -- e.g., spinal fusion surgery, spinal injections and the prescription of opiates -- has skyrocketed in recent years, according to medical researchers.

There are many potential reasons for this spurt in back treatments, including the heavy commercialization and direct consumer marketing of treatments both old and new. It is hard to read a newspaper, watch TV or surf the Internet without seeing a commercial pop up for the latest treatment for low back pain.

Obviously, there is a lack of definitive evidence regarding many popular treatments, which allows them free rein in the marketplace before the risks and benefits can be scientifically studied and documented.

The JAMA study stated that 60% or more of initial back surgeries have successful outcomes. I am pretty good at math, so that means 40% DO NOT!  The study's authors estimated that the 40% equates to 80,000 "failed back surgeries" a year.

The researchers also observed that the surgical success rate drops to 30% after the second surgery, 15% after a third and 5% after a fourth. The authors believed that many patients were under the care of physicians, "who are unfamiliar with the conditions leading to back surgery, the types of back surgery available and the best approaches to diagnosis and management."

The annual medical cost to American businesses because of low back pain was estimated to be $90 billion in 2008.  This does not include the cost of related workers' comp or disability benefits, which also are in the billions, nor indirect costs such as lost productivity.

The medical studies have confirmed what I have known and studied for the past 33 years: Much of the money spent on healthcare -- approximately one-third -- is wasted on medically unnecessary and potentially harmful procedures.

What has changed in the treatment of low back pain since the release of the studies in 2008?

My bet: Not so much.

In fact, some medical researchers have stated the situation has gotten worse, not better, and that they have not been able to keep up with all the latest trends and back treatments available today.

Daniel Miller

Profile picture for user DanielMiller

Daniel Miller

Dan Miller is president of Daniel R. Miller, MPH Consulting. He specializes in healthcare-cost containment, absence-management best practices (STD, LTD, FMLA and workers' comp), integrated disability management and workers’ compensation managed care.

Is That Opportunity Calling in the 'Sharing Economy'? (Part 2)

Start-ups in the car-sharing economy are attracting major interest among investors and consumers. There is one area where the start-ups have not gained traction—insurance.

Last week, we looked at the potential of the sharing economy and some of its top performers.This week, we’ll explore how insurance fits into that picture.

Start-ups in the car-sharing economy are attracting major investors who believe in their business model. There is, however, one area in which start-ups have not been able to gain traction—insurance. Many tell of cold calling insurance companies; some have reached out to insurance executives via LinkedIn. A few have been successful. For example, Getaround, a car-sharing service, was able to work closely with insurers to secure coverage by delivering a solid risk model. Further, the company is collecting information on its consumers to help start providing the data that insurance companies need to underwrite car-sharing activities. However, success is not the norm.

One major insurer, for example, specifically rewrote its personal auto policies to exclude car-sharing. A company spokesperson for another large insurer stated that, “The owner could put their current coverage for personal use of the vehicle in jeopardy as the act of making the vehicle available for rental purposes could inherently change the risk profile of the vehicle. And, by entering into commercial arrangements with their vehicle, the insured may risk being unable to secure auto coverage from our company in the future.”

Legislators have also gotten into the game. A few states have started to make inroads into the insurance challenge. For example, California and Oregon both state that a personal auto policy cannot be considered commercial, even if the owner participates in car sharing. However, the law also declares that the auto-sharing company, not the owner’s insurer, is responsible for any damage caused during car-sharing activities. In other states, legislation has not been as supportive. For example, New York state issued a cease-and-desist order against RelayRides when its insurance coverage was declared “illegal and inadequate.”

A few innovative companies are experimenting with different insurance models. MetroMile, for example, lets drivers pay for insurance by the mile. Drivers simply plug a device, called the Metranome, into the car’s onboard diagnostic switch to count miles driven. A UK-based company, jFloat, allows consumers to buy into a “collaborative consumption self-insured pool” through the Web. A reinsurer backs the pool when claims reach over the maximum amount. While these particular models do not directly apply to the car-sharing business today, they are heading in the right direction. It’s companies like these that are thinking about how to combine insurance with emerging technologies that may provide a disruptive insurance model for the sharing economy.

In the meantime, car-sharing enthusiasts are not idly sitting by waiting for insurance companies to respond. Instead, they have been reaching out to insurers and legislators to help them better understand the business and risk models. The goal is to provide insight into the needs of the car-sharing market and work with insurers and legislators to develop solutions. While it is to be expected that companies like RelayRides and Getaround would be proactive, a new consumers group has also emerged. Called Peers, it represents the renters’ side of the equation, advocating for their needs and their protection. Even universities are getting into the mix to help create solutions. For example, the University of California at Berkeley’s Transportation Sustainability Research Center regularly publishes a report on the auto-sharing industry. Its conference on the topic will host a session on "Insuring Shared-Use Mobility Services."

Investors, consumers, governments and legislative bodies are all weighing in on the car-sharing market. The only industry that has remained relatively silent is insurance.

Next week, we’ll look at how insurance companies can evaluate the sharing economy opportunity in light of their individual business models and risk appetites.