Cyberrisk: ‘Healthy Dose of Paranoia’ Needed

With the escalation of cyber attacks affecting the health care industry, companies in the workers' comp field must become more vigilant in their efforts to safeguard data.

By: Nancy Grover | July 20, 2015

The workers’ comp system has been generally spared from data hackers. But with the multitude of people and companies transmitting and sharing files daily, it is incumbent upon companies to take protective actions, advises a managed care services provider.

Data breaches at some of the country’s largest health plans as well as among retailers has prompted Genex Services, LLC to offer suggestions to protect the industry. In addition to recommended steps to take, a new white paper also includes basic regulatory issues and terminology to help industry stakeholders better understand data concerns and the need to collaborate with partners and vendors.

“Our industry certainly could be, and perhaps already is, at risk,” notes the paper. “Lack of strong data security could expose an organization to millions of dollars in litigation, damage control and repair costs.”

The document, Enemy at the Gate: Data Security Risks in Workers’ Comp, outlines the potential risks and offers advice.

“A healthy dose of paranoia is a necessity for today,” the paper states. “It is clearly in the best interest of our industry, and of workers, to err on the side of caution.”

The Risks

“The ability to show strong data security controls is critical for employers and carriers,” the paper advises. “Companies want assurance that their data will be stored and backed up securely and in a physically safe location, that there are controls for who can access data, who can share information and the manner in which data is shared, e.g. secure email server.”

A number of “key domain risks” face the industry such as unauthorized access to personal health information. Such information “could be used for identity theft or even blackmail,” the paper says. “Unfortunately, there are many ways for such data to be accessed. Data is always in motion in comp claims as there are various vendors, case managers, bill review specialists, and independent medical examiners, all transmitting and sharing files and forms every day.”

“A healthy dose of paranoia is a necessity for today. It is clearly in the best interest of our industry, and of workers, to err on the side of caution.”

Carefully vetting vendors and properly managing passwords are among the methods to ensure security controls are effective. Passwords, the paper advises, should be “easy to remember, but not overly simplistic and be changed more than twice a year to reduce potential risks.” Password parameters should be developed for “all applications and networks.”

Sending claim information over the Internet is risky. The emphasis on mobile workplaces “exacerbates risk from the Internet.”

The authors advise companies to remind employees to “remain vigilant” when adjusters, providers, and injured workers are sending emails that include addresses, dates of birth, and Social Security numbers through non-secure servers. “These senders need to be informed and educated of the dangers associated with nonsecure platforms,” the document states.

Securing Data

Administrative, technical, and physical controls should be implemented. Administrative controls, for example, include conducting background checks and using confidentiality agreements, as well as security awareness training. Anti-virus, network segmentation and web and email filtering are among the technical controls that should be put into place.

Physical controls relate to limiting access to buildings and data access. Key fobs or card entry building access systems are recommended. A “security triangle” should be created to ensure all controls are highly secured and monitored.

Steps to Take

Organizations can take a variety of measures to ensure the security of sensitive data. Continually reviewing and improving technical controls and providing clear guidance and instruction to employees transmitting data are among them. Antivirus programs should be installed on all systems and virus definitions should be updated frequently, such as every three hours.

The paper offers a variety of additional tips, including:

Encrypt data on the C drive, data-in transit, and databases on servers to protect data, in case a laptop is lost or stolen.

Implement a system to determine which department or individual can access data and limit the number of people with full access to everything.

Guard against email phishing to avoid scams. “Be aware of anything involving shipping or delivery of product, and warn employees to be especially wary of unsolicited emails purporting to be from government agencies and popular internet commerce sites, such as the IRS or PayPal, especially during tax season, and high volume online shopping periods,” the document recommends.

Instruct vendors to tell their own employees of the importance of security to ensure all links in the data security chain are strong.

Insufficient Standards

The paper is the latest to address concerns of potential data breaches in workers’ comp. Cyber security is among the targets for Sedgwick this year.

In a recent blog post, Sedgwick’s senior vice president and information security officer Robert Jackson suggested the health care industry has set the bar on data security too low. “You may think you have taken the steps needed to protect your company’s data,” Jackson wrote. “How does your data security currently stack up?”

Jackson poses a series of questions on tools to protect data and points out that many “standards” are insufficient. For example, antivirus software is not the best protection against malware, he says. “Traditional antivirus software can only protect against things it has previously seen; new malware is specifically designed to constantly change itself to bypass traditional antivirus software.” He points to application whitelisting software as the best replacement for antivirus software on workstations and servers.

Penetration testing is not the best way to double-check Internet facing software so it cannot be hacked. Instead, he says tools such as binary code testers analyze logic and software vulnerabilities for all programming in an organization’s code, not just the code operating when regular testing occurs.

Nancy Grover is the president of NMG Consulting and the Editor of Workers' Compensation Report, a publication of our parent company, LRP Publications. She can be reached at [email protected].

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

By: Risk & Insurance | April 3, 2024

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.

Technology Risks