More Buyers Seek Cyber Cover
Cyber insurance is not just for retail organizations and health care companies any longer, the latest research shows. This year, brokers have begun seeing some fairly dramatic increases in the percentage of manufacturing clients, and power and utility firms purchasing stand-alone cyber policies, according to a new report from Marsh.
The trend illustrates the fact that more clients are seeing the need to cover risks associated with their technology not working and doing damage to digital assets, said Bob Parisi, Marsh senior vice president and technology product leader.
Take-up rates for cyber programs among existing Marsh clients in the power and utilities industry more than doubled from 9 percent to 19 percent from 2014 to 2015, according to Marsh’s midyear benchmarking report.
The report also found that manufacturing client purchasing cyber coverage rose from 6 percent to 11 percent.
In the past, Parisi said, client-facing companies in the retail, health care, and finance sectors had the lead in purchasing cyber insurance to protect the privacy of their customer data. That is still the case, he noted: For instance, both new and existing Marsh health care clients were the largest purchasers of cyber coverage (41 percent) in the first half of 2015.
At the same time, however, “other businesses have begun to realize that breaches could also corrupt or destroy their software, which is an asset like a building is an asset,” he said.
“More than 60 carriers now offer stand-alone cyber insurance policies.” –Insurance Information Institute
“This is property not typically covered under a property policy,” Parisi said, “since we are talking about protecting intangible assets from a physical peril like computers at a data center not working due to a virus.
“That is a critical change in the nature of the insurance buyer and what they are thinking of,” he added.
Cyber Purchases Increase
Marsh found that overall, the number of U.S.-based Marsh clients purchasing stand-alone cyber insurance increased 32 percent in the first-half of 2015, compared to a 26 percent growth rate in the first half of 2014.
Other brokers are seeing similar increases. Willis, for instance, saw 37 percent growth during the first half of this year, compared to 28 percent for the same period last year, said Willis’ Geoffrey Allen, executive vice president, cyber and E&O practice leader, FINEX North America.
The sectors showing the largest growth in purchase of stand-alone cyber insurance were the education sector (an increase of 155 percent in the first half of 2015) and transportation (an increase of 150 percent).
Also increasing, said Marsh’s Parisi, are the prices paid and limits sought by cyber insurance buyers.
“On average, our limit purchase has gone up,” Parisi said. “Limits were up 18.1 percent last year and it’s closer to 21.6 percent this year, he said.
Retailers on average paid 32 percent more for cyber coverage in the first half of 2015, Marsh found, compared to average price increases of 19 percent for all other industries.
“Premium increases [for retail companies] depended on a number of variables including size, loss experience, and information security controls and practices with emphasis on tokenization and encryption.” — Geoffrey Allen, executive vice president, cyber and E&O practice leader, FINEX North America
Willis also found that premium for retailers have increased generally of late, with many customers purchasing higher limits, Allen said.
“Premium increases depended on a number of variables including size, loss experience, and information security controls and practices with emphasis on tokenization and encryption,” Allen said.
Meanwhile, a new report from the Insurance Information Institute, found that insurance carriers are getting better at providing cyber coverage.
“Insurers are issuing an increasing number of cyber insurance policies and becoming more skilled and experienced at underwriting and pricing this rapidly evolving risk,” according to the report, “Cyber Risk: Threat and Opportunity.”
“More than 60 carriers now offer stand-alone cyber insurance policies,” according to the III, using Marsh statistics that found that the U.S. cyber insurance market totaled more than $2 billion in gross written premiums in 2014, with some estimates suggesting it has the potential to grow to $5 billion by 2018 and $7.5 billion by 2020.
The III report also confirmed that cyber rates are firming: “Industry experts indicate rates are rising, especially in business segments hit hard by breaches over the past two years.”
On the other hand, the report found, the risk may be too much for the private insurance sector to handle.
“Some observers believe that cyber exposure is greater than the insurance industry’s ability to adequately underwrite the risk,” said the III.
“In 2014, the number of U.S. data breaches tracked hit a record 783, with 85.6 million records exposed,” it said. “In the first half of 2015, some 400 data breach events have been publicly disclosed as of June 30, with 117.6 million records exposed.”
III noted that researchers have estimated the likely cost of cyber crime to the global economy ranges between $375 billion and $575 billion.
“Cyber attacks have the potential to be massive and wide-ranging due to the interconnected nature of this risk, which can make it difficult for insurers to assess their likely severity,” said the report.
“Several insurers have warned that the scope of the exposures is too broad to be covered by the private sector alone, and a few observers see a need for government cover akin to the terrorism risk insurance programs in place in several countries,” the group concluded.
Revitalizing the Program
Anne-Marie Amiel assumed her post at Columbus Consolidated Government in Georgia three years ago, becoming the first risk manager for the consolidated City of Columbus and the County of Muscogee government in over a decade.
Since then, she and a colleague have been successfully reconfiguring the government’s workers’ compensation, liability claims and safety programs.
Given the short amount of time she’s been working there and her limited resources, it’s uncanny how many accomplishments the first consolidated city-county in Georgia has produced.
Amiel has not only substantially reduced the time spent by employees on leave by revamping the return-to-work program, but she has reduced costs per claim, enhanced the workers’ comp process and begun overhauling safety and training procedures.
The reduced volume of lost-time days experienced by the public entity and its 3,000 employees has been a great benefit to Columbus — in more than just fewer days off the job.
In 2011, the average number of days out of work for government employees was about 109, Amiel said, noting that she took oversight of the program for the entire year in 2013, when the number dropped to 53.
In 2014, the number was 28, nearly half of the 59-day figure projected by the Department of Labor’s National Disability Guidelines for that year, Amiel said.
So how did she do it?
An enhanced return-to-work program for employees with limited capacity played a big role.
“Often the doctor says that an employee can come back to work but cannot do all
the essential functions of their job,” said Amiel. ”If someone has a knee injury, for instance, they often can’t be driving heavy equipment but could be driving something smaller.”
Amiel understood that offering light duty to more employees was not only good for the company and its self-insured workers’ comp program, but was also psychologically beneficial to workers.
“If someone is injured and out of work for more than 12 weeks, psychologically they tend to start thinking of themselves as disabled, and it gets to be harder and harder to bring them back to work,” Amiel said.
To make the process more effective, she centralized the return-to-work program instead of leaving it to various government divisions to handle their own employees.
In the past, Amiel said, many of Columbus’ departments would provide only as much light or transitional duty as could be absorbed within their own divisions, meaning that large numbers of employees unable to take on full duties had no choice but to stay at home and collect workers’ compensation checks.
Under Amiel’s supervision, that has changed.
“I have worked with all of our departments to allow their employees to be provided light duty in another department when there is none available in their own.”
One striking example of the new policy resulted in additional monetary benefits to the government.
A police officer who was not able to perform her normal duties was placed in the public works department, where she helped create a database of addresses for Columbus, and identified a cross-referencing system failure with a local utility’s database.
“I have worked with all of our departments to allow their employees to be provided light duty in another department when there is none available in their own.” — Anne-Marie Amiel, risk manager, Columbus Consolidated Government, Georgia
As it turned out, a local water utility was using an outdated address list, meaning that Columbus’ water bill mistakenly included trash collection charges for several new addresses, while Columbus was collecting trash at those locations without pay.
Now able to collect accurate fees for services provided, “the increase in Columbus’ revenue due to that one light-duty assignment between 2013 and 2014 has been approximately $100,000,” Amiel said.
“I am still assigning people from other departments to public works duty to help them with the water department database,” said Amiel.
“Like most employers these days, we have a lot of tasks that need to be completed but insufficient personnel to perform them,” she said. “Utilizing light-duty employees to accomplish these tasks is beneficial to both employer and employee.”
Lower Costs Per Claim
That was only the beginning. Through Amiel’s efforts, the government’s total incurred cost per claim (the sum of medical and indemnity benefits and other incurred costs for all claims, divided by the total number of all claims) has dropped dramatically.
Costs per claim dropped by more than 60 percent over three years, from $9,971 in 2011 to $3,641 in 2014.
After Amiel began exercising oversight of the program, the organization’s total medical costs per indemnity claim dropped from $6,307 in 2011 to $2,014 in 2014. An indemnity claim is paid when the employee is out of work and is receiving the wage benefit from workers’ compensation.
One key step leading to these improvements was a change in Columbus’ third-party administrator and a move to managed care in early 2014. Today, Columbus is using USIS/AmeriSys as its TPA and managed care organization (MCO).
The shift was transformational, said Amiel.
“Under the old system, the people managing our claims were not medical professionals,” she said. “I really wanted a medical professional who could triage with our employees when they were hurt and help guide them to the correct treatment.”
At AmeriSys, a nurse case manager handles the medical side of all claims — and only Columbus’ claims. That makes a difference, Amiel said.
“With a workforce of over 3,000 employees, we need people who understand our culture and who get to know our employees,” she said.
Also instrumental to Columbus’ improvements was moving away from the state’s so-called “panel system.”
“In Georgia, the law says that if you use that system you need a list of six unique medical providers your employees can tap when they are injured,” Amiel said.
“The panel needs to include one minority member, for instance, one orthopedic specialist, and one walk-in provider, among others.
“The problem has increasingly become we have larger practices buying out smaller ones so it can be difficult to find six quality providers.”
Managed care acts as an alternative to the panel system for Columbus, she said.
“Under managed care, what happens is the MCO gets approval from the state workers’ comp board for a whole network of providers and we now have access to over 200 providers,” Amiel said.
“Our MCO system provides both 24/7 coverage and medical management of claims, plus a larger network of available medical providers than does the panel system.
“I have visited all of our regular medical providers so that I could make sure they know the city has a ‘face’ and someone on whom they could call if they need more information on an employee or if they want to discuss potential light duty work.”
The new system’s utilization review is also “one of the keys to cost control of injury claims.”
She noted that under the panel system “any dispute brought before the State Board of Workers’ Compensation would essentially have a doctor’s opinion on one side and a professional adjuster’s on the other. If you were a judge, would you not take the opinion of the doctor over the adjuster? I know I would,” she said.
With the MCO system, there is a peer review system at an earlier stage than a court hearing. That peer review can result in medical professionals talking to other medical professionals and coming to a consensus on the appropriate course of treatment.
That works to the benefit of the employee and gives the employer a greater confidence on the treatment plan being implemented, she said.
“When one utilizes an MCO system there is a much more robust peer review system,” Amiel said.
Loss Control Strategies
Since bringing on the new TPA, Amiel said, she has been tracking accident trends and using that information to discuss potential safety improvements to work environments with Columbus’ department heads.
“For instance, we have stepped up employee training and workplace inspections provided to our employees, including different forms of driver training to include not only standard vehicles, but also vans and larger trucks,” she said.
“I have also rewritten our accident review policy to bring it more in line with national standards,” she said. “We have adopted a system that is widely in place nationally, whereby employees are assigned points for various types of at-fault accidents according to the degree of severity.
For example, a trash truck that hit a mailbox would be assigned fewer points than the driver of a city vehicle that hit a stopped car at an intersection.
“Disciplinary actions are given in a progressive manner,” she said.
Among those who are impressed by Amiel’s efforts is Columbus, Ga. Mayor Teresa Tomlinson.
“We have seen a transformation in our workers’ comp claims system through a more engaged management effort and best practices techniques,” Tomlinson told Risk and Insurance®.
“In three years, we are down from [roughly] $10,000 per claim to $4,000 per claim. That comes from having diligent in-house workers’ comp personnel and a systematic approach to deal with the injuries and claims of our employees expeditiously.
“We are better able to assess their needs and get them healthy and confident to return in just 28 days on average.”
“Of course,” she said, “the best investment we can make for taxpayers is education and training through our safety plan. If the injury never happens, we are all better off and that’s our goal.
“In the event of an injury, our efforts turn to investing in a system that gets our valued employees healthy and safely back to work.”
Read more about all of the 2015 Teddy Award winners:
Revamped Program Takes Flight: The American Airlines and U.S. Airways merger meant integrating workers’ compensation programs for a massive workforce. The results are stellar.
Checking Out Solutions: From celebrating safety success to aggressively rooting out fraud and abuse, Stater Bros. Markets is making workers’ comp risk management gains on multiple fronts.
Revitalizing the Program: In three years, the Columbus Consolidated Government was able to substantially reduce workers’ compensation claims costs, revamp return-to-work and enhance safety training.
Spreading Success: Barnabas Health wins a Teddy Award for pushing one hospital’s success in workers’ comp systemwide.
R&I: What was your first job?
My first job ever was for the Newark Star Ledger. I used to deliver papers in the morning before school. I was probably about 12 years old.
R&I: How did you come to work in risk management?
I was working in the liability claims area in New Jersey and Delaware for ESIS, a TPA that is part of ACE. Then when I came to Arizona I worked for a couple of excess and surplus insurance companies in the claims area. I just got to the point where I was looking for a change but wanted to be able to use my claims skills and risk management seemed to be a perfect fit.
R&I: Where did you start out?
My first risk management position was with Elizabeth Arden Spas, where I began working in 2006. I stayed on until 2013.
R&I: What is the risk management community doing right?
I think we’re creating visibility for ourselves by demonstrating vision and value. In my view, risk management is the blending of science and art. You’ve got to be creative in how you approach everyday challenges, but then you have to translate information into concrete numbers to provide to the financial side of the business, again establishing value. That is really a great part of what we do.
R&I: What could the risk management community be doing a better job of?
I think we could do a better job at establishing support and purpose for risk management education at the university level. There are some programs out there, and I think we could do more to promote existing ones and to create new ones.
R&I: What emerging commercial risk most concerns you?
Being in the food manufacturing business, we are always very aware of contamination issues. We’ve seen a lot of recalls this year with a variety of different things involving produce, ice cream, hummus and more. I think that the risk management community and insurance industry must remain diligent in efforts to maintain effective supply chains and distribution channels.
R&I: What insurance carrier do you have the highest opinion of?
The one I have the highest opinion of is the one that responds when I have a problem. Our organization is so large and complex that when I have a problem I need someone who can address the scope of what my risk is. It could be AIG, or ACE, Travelers, Liberty or virtually any commercial insurer that has depth and resources.
I’m going to say optimistic. I’m generally a “less regulation” person, so I think if companies had the benefit of having less regulation, in a general context, we could be doing even better.
R&I: Who is your mentor and why?
Actually many of the people I’ve met through RIMS have been mentors to me. But I want to particularly mention two women, the first being Lynn Lovell, who has been a mentor for me since I entered the risk management community. She is a risk manager and an educator and does a lot of in-person and online teaching. I would also mention a woman by the name of Jackie Wanta, who is a construction account manager for broker Lovitt & Touché. I met her through Lynn and she lives down the street from me so we spend a lot of time talking about industry topics. She is also a former president of the “Big I” (Independent Insurance Agents & Brokers of America) here in Arizona.
R&I: What have you accomplished that you are proudest of?
I have two things to mention: I trained for and ran a half-marathon a few years back. It was one of those things I just thought I’d never be able to do. Also the completion of my MBA. Those two things really gave me the ability to understand that I could accomplish whatever I wanted and that led me to the place I am today.
I like this work because it’s different every day. You don’t know what’s going to happen or the challenges you’re going to be handed on any given day.
R&I: What’s the best restaurant you’ve ever eaten at?
There is a steak house here in Scottsdale called City Hall. I really enjoy that restaurant because the food is simple but so well done that it’s exquisite.
R&I: What is your favorite drink?
I really had to think about this one: It’s my morning coffee! After that, its probably water. But I just love the experience of coffee in the morning.
R&I: What is the most unusual or interesting places you have ever visited?
I haven’t travelled too much outside of the United States, so I would have to say Times Square and Las Vegas. In both places, particularly Times Square, you just see every range of person in just about every point in their life, with every type of emotion that you could imagine. It’s just fascinating to watch those people.
R&I: What is the riskiest activity you ever engaged in?
Inviting two of my nieces to move in with me when they were trying to launch their careers after graduating college. It’s so important to have a mentor and a support system at that stage since it will impact the rest of that person’s life. I took that vocation very seriously because I was aware of how I could impact these girls.
R&I: What do they do now?
One is about to become a senior accountant for a company called SilverRock. The other is an accounting assistant for broker Risk Placement Services in Scottsdale.
R&I: If the world has a modern hero, who is it and why?
At the risk of sounding cliché I think it’s the military, the police and the firefighters. These people put their lives on the line every day and yet are so humble, and ask for so little in return.
R&I: What about this work do you find the most fulfilling or rewarding?
I like this work because it’s different every day. You don’t know what’s going to happen or the challenges you’re going to be handed on any given day.
R&I: What do your friends and family think you do?
I don’t think they know what I do. They do know I am a great reference for insurance-related questions, but unless they are industry people, I don’t think they know what I do.