Unquantifiable Exposures

Top Five Uninsurable Risks

The complexities and nuances of these risks make it impossible for risk managers to find total coverage.
By: | September 2, 2014

Whether it’s a Sriracha hot sauce maker being threatened with closure by city council or General Motors fighting for its reputation after recalling more cars than it made in the past three years, companies face a world of complex risks.

And some of those risks cannot be transferred via insurance products.

Advertisement




How well are companies protected, for example, when new regulations get passed — such as the EPA’s proposed restrictions on coal burning plants that may drive some in the energy industry out of business, or the current political drumbeat against tax inversion practices?

What insurance covers a company whose rogue employee sells trade secrets to an outside company? How about when a pandemic shuts down operations?

Risk managers identify their organizational exposures as best they can and then work to manage or eliminate those risks. Sometimes, commercial insurance can be used to remove the bulk of that risk, but we’ve isolated five risks which many experts believe are uninsurable in many respects: For the time being anyway.

“For the most part, the insurance industry rises to the occasion and creates products for emerging risks that evolve over time,” said Carol Laufer, executive vice president, ACE Excess Casualty.

“For insureds, the purchase of products such as employment practices and cyber insurance eventually evolves from a discretionary spend to standard insurance coverage,” she said.

09012014_01_CS_sidebarWhile some coverage is available, these five threats are considered mostly uninsurable: reputational risk, regulatory risk, trade secret risk, political risk and pandemic risk.

For sure there are other challenging risks — such as weak economic conditions or skilled talent shortages — that also are uninsurable, but we have selected those for which risk managers are able to play an effective role in mitigating the risk.

Part of the problem in transferring such risks is the complexity involved in the exposures. Look at tax inversion — where a U.S. company merges with a foreign company to change their tax jurisdiction and lower their tax burden.

Is that a political risk? A regulatory risk? A reputational risk? It could be any one of them, or all three of them.

“I think it’s almost uncountable the ways that a loss could occur where that loss could be tied back to reputational risk or regulatory risk,” said David White, a national actuarial leader at KPMG.

At the same time, calling a risk uninsurable has nuances to it. Coverage for criminal fines and penalties, for example, are truly uninsurable. The law forbids such coverage, said Patrick Donnelly, chief broking officer, Aon Risk Solutions.

Advertisement




But for other types of risks, there may be various products offered by brokers and underwriters to address some, but not all of the specific exposures faced by a company, he said. Such coverage, however, may be rare or expensive, or corporations may find risk transfer to be an ineffective way of hedging the risk.

“I’m very careful about branding something as truly uninsurable,” Donnelly said.

“It’s not black and white.”

1) Reputational Risk

General Motors might be the quintessential example of a company undergoing a reputational hit. It recalled nearly 30 million cars, and faces numerous lawsuits and investigations related to a delayed recall of 2.6 million cars — some manufactured more than a decade ago — with a faulty ignition switch that has been linked to 13 deaths and more than 50 accidents.

Video: As this report from the New York Times indicates, automakers have a long history of trying to maintain their reputations in the face of major recalls.

But every day brings another contender for the throne. One day, it’s American Apparel’s founder being suspended, and possibly eventually fired, for alleged sexual misconduct. Another day, it’s a viral video of a Comcast customer service representative who refuses to let a customer cancel his account.

Or it could be yet another cyber theft of customer information or a celebrity spokesman tweeting out an offensive comment.

While there are insurance products that provide coverage for crisis management/public relations costs and product recall expenses, only a limited market exists for loss of income or net profit for reputational harm, said Emily Freeman, global technology and privacy practice specialist at Lockton.

“You need to be able to wrap your arms around the risk and the value of risk before you can insure it,” said Tom Srail, senior vice president, Willis. “What a company name is worth has long been a risk to the industry.”

Freeman said Lockton has been involved in creating customized solutions for large clients that address specific threats of reputational harm. The client and underwriter negotiate the period of indemnity and loss adjustment, she said.

“The perils are not on an ‘all risk’ basis, but rather categories listed that are relevant to the client, such as disgrace of key persons or breach of sensitive data,” Freeman said.

“In my mind,” said KPMG’s White, “you can’t find policies that cover all types of reputational risk from whatever event that occurred.”

2) Regulatory Risk

When you think of regulatory risk, many risk managers keep an eye on the rules of the Health Information Portability and Accountability Act (HIPAA), the Dodd-Frank Act or a regulatory agency such as the Food & Drug Administration.

But the threat of regulation is immense and often unpredictable. In just one year, 2012, there were 17,763 changes to laws, rules and regulations affecting the banking and financial sectors alone, according to The Network, a training and compliance company.

“From a risk management or risk mitigation perspective, you can’t really predict regulations. You can prepare for them, but you can’t predict them or price them.” — David White, national actuarial leader, KPMG

Plus, risks can emanate from all sectors of government. One recent example is Huy Fong Foods, the manufacturer of Sriracha hot sauce, which was temporarily shut down by a judge following a lawsuit by the city council of Irwindale, Calif., after four families (one of which was related to a city councilman) complained about odors.

Eventually, the city dropped its lawsuit and its declaration that the factory was a “public nuisance,” but it took months for the situation to resolve itself.

“From a risk management or risk mitigation perspective, you can’t really predict regulations. You can prepare for them, but you can’t predict them or price them,” White said. “Regulatory risk is handled through risk mitigation, not risk transfer.”

Tom Srail, senior vice president, Willis

Tom Srail, senior vice president, Willis

“Even in the United States,” Srail said, “a government or state can put an industry or a company, if they want to, out of business or severely restrict their ability to operate.”

Certainly, the energy industry has been facing that threat since 2008 when President Obama noted that coal-powered plants can still be built, but at a steep regulatory cost.

“It’s just that it will bankrupt them because they are going to be charged a huge sum for all that greenhouse gas that’s being emitted,” Obama said.

Advertisement




While a final rule has not yet been issued by the Environmental Protection Agency, the president has recently called on it to enact new emissions regulations. The U.S. Chamber of Commerce estimated the regulations will cost the economy about $50 billion annually.

“There are some creative products underwriters have tried over the years … but there is definitely nothing off the shelf or run of the mill,” Srail said of regulatory risk.

“There’s nothing easy to do.”

3) Trade Secret Risk

“I find trade secrets to be one of the most dangerous areas,” said attorney Rudy Telscher, a partner at Harness Dickey & Pierce, who recently won a patent infringement case at the U.S. Supreme Court.

“There are no boundaries. It’s such a nebulous area.”

It can include anything from a disgruntled employee taking customer lists or R&D information to his next job, a foreign government stealing trade secrets or a hacker burrowing into a computer system to steal a company’s version of its special sauce.

Globalization and the expanded use of supply chain partners increase the potential exposure. Plus, even when a company is able to pursue trade secret litigation, courts consider whether reasonable precautions had been taken to secure the proprietary information.

“The violation,” said Bob Fletcher, president, Intellectual Property Insurance Services Corp., which offers insurance to litigate intellectual property cases, “is not the use [of a trade secret]. The violation is, ‘How did you get the information?’ ”

In any event, said Aon’s Donnelly, “an organization would have a very difficult time obtaining an insurance policy that adequately protects them against the theft or wrongful disclosure of their trade secrets and the potential damage that could do to the company if that trade secret got out.”

Rudy Telscher, partner, Harness Dickey & Pierce

Rudy Telscher, partner, Harness Dickey & Pierce

More common than industrial espionage, however, are the run-of-the-mill business discussions that revolve around synergies and potential partnerships between enterprises. Often, the nondisclosure agreements (NDAs) covering such discussions are not specific enough to protect the parties, Telscher said.

It is the party receiving the information that is most at risk, he said. If the discussions dissolve, that party may find itself accused of acting upon trade secrets because the NDA did not specify the information that was to be disclosed and held confidential.

“The more information you receive, the greater the risk there will be a lawsuit if you don’t end up doing a deal and you move forward on your own,” Telscher said.

4) Political Risk

In this era of globalization, companies establish operations all over the world, and the world is not a stable place.

Upheaval — or the increasing threat of it — is prevalent on just about every continent of the globe. Certainly, the possibilities in the Middle East, Eastern Europe, Asia and Latin America are concerning to risk managers.

An Emergencies Ministry member walks at a site of Malaysian airliner flight MH17, which was brought down over eastern Ukraine, killing all 295 people aboard.

An Emergencies Ministry member walks at a site of Malaysian airliner flight MH17, which was brought down over eastern Ukraine, killing all 295 people aboard.

While political violence and trade credit coverage is available in the majority of cases, companies continue to face uninsurable exposures.

“It’s definitely tricky,” said Mark Garbowski, a shareholder at Anderson Kill.

Advertisement




“Based on the policies I have seen, there will always be some aspects of it that will be fully outside the scope of what can be covered.”

And only “a minority” of companies actually buy the cover, said John Hegeman, AIG senior vice president, specialty lines-political risk.

“I think the principal reason is most risk managers view it as a self-insured business risk,” he said.

“Pretty much anything an insured thinks is really essential to their operations can be covered, but you have to identify it and understand what it is.”

Often, said Richard Maxwell, chief underwriting officer and global head of political risk and trade credit insurance for XL Group, corporations wait too long in the face of deteriorating conditions and insurers will not accept the risk.

“Buy the cover before the barn is on fire,” he said.

Generally, policies cover a host of risks, including government expropriation of an asset, destruction of an asset due to war or political violence, credit default of trade receivables, and when foreign governments block transfer and convertibility of currency.

Some countries, such as Iran, Iraq, Afghanistan and the like, are not insurable, said Jochen Duemler, CEO and head of Euler Hermes Americas Region, which offers risk coverage in nearly 200 countries.

Argentina is a recurring problem, and as for Venezuela, it’s not uninsurable, he said, “but we would say we pretty much have no exposure there and are very, very reluctant” to offer coverage.

Overall, policies exclude losses that occur when currency is devalued, losses that occur as a result of a nuclear incident and non-payment of premium, or any losses to suppliers or partners as a result of political violence, except for trade receivables.

Policies also require insureds to make certain warranties and representations that are included in the insurance contract.

Policy disputes can arise when property is expropriated or licenses are cancelled due to what a foreign government says are reasonable or legally justified regulatory actions, according to an article on political risk coverage by Robert C. Leventhal, an attorney with Foley and Lardner.

Another area of dispute emerges when assets are jeopardized by “creeping expropriations,” such as a series of actions by the government as opposed to a single act, he said.

5) Pandemic Risk

Many risk managers aren’t too worried about the Ebola pandemic in West Africa that has already killed more than 900 people. And they probably aren’t all that worried — if they even know — about the four cases of pneumonic plague in Colorado that are life-threatening.

But who among them can forget the H1N1 pandemic influenza virus known as the swine flu, that in 2009 killed more than 250,000 people worldwide, including more than 3,600 in North America.

At one point, the U.S. Centers for Disease Control and Prevention estimated that as many as two in five workers might become infected or have to stay home to care for an ill family member.

Video: Researchers at the Massachusetts Institute of Technology studied the role airports play in spreading disease and pandemics, according to this report by Voice of America.

A pandemic flu is something all risk managers should worry about. And there’s no coverage for it.

“A pandemic is a very difficult exposure to insure in any meaningful way. You can do some work around it, but it’s a very, very difficult risk to insure and no one really insures it,” said John McLaughlin, managing director of the higher education practice at Arthur J. Gallagher & Co.

For schools or universities, his specialty, there may be some loss of tuition coverage available, but “it’s not very cost effective.”

Advertisement




For business, supply-chain insurance may offer some protection, but that coverage still has a limited take-up.

Companies may also be able to craft special wording for property or D&O policies, he said.

“You never say never. There’s always some solution that you can work up,” he said.

But, McLaughlin said, a healthier perspective for a risk manager is to analyze how the risk would impact the organization and to devise solutions that are not insurance-related.

The late Anne Freedman is former managing editor of Risk & Insurance. Comments or questions about this article can be addressed to [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.

PART ONE: CRACKS IN THE FOUNDATION

Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.

PART TWO: BETRAYAL

As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.

PART THREE: FALLING DOMINOES

Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &

Bar-Lessons-Learned---Partner's-Content-V1b

Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.




Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]