Quickly emerging as the new-product darling of the Property and Casualty insurance industry is Cyber Liability insurance. Although the Sony PlayStation Network (PSN) incident is the most notable recent hack of customer data, the Privacy Rights Clearinghouse (PRC) catalogs 2,451 data breaches made public since 2005 exposing 598,410,625 customer or employee records to unauthorized users.

The Clearinghouse is particularly useful for making available not just hacking information but a taxonomy of breach types that can help organizations identify the exposures their organizations need to pay particular attention to.

Insurance response to this taxonomy is varied, with some breach types covered by traditional insurance, e.g. credit card fraud (CARD) or the disclosure of information by someone with legitimate access to the information (INSIDER) while others are the subject of a relatively new and rapidly evolving insurance coverage type often lumped under the rubric of "Cyber Risk". The traditional insurance responses are certainly evolving as well, witness the Hartford Insurance Company Employee Data Privacy Liability Endorsement which can be made part of at least their Private Choice Encore! policy.

Insurance products appear to fall into two major "buckets", Network Security and Privacy that can provide first-party and third-party coverage. Also, critical to any Cyber Risk policy is the provision of crisis management services and generous limits of liability available to respond to violations of privacy regulations to include notification and credit monitoring.A summary of state security breach laws can be found here.

Network Security concerns itself with liability to a third-party for the destruction, deletion or corruption of their data caused by the failure of an organizations network security to protect such third-party data. This concerns not just third-party data that an organization might have on it servers but also (and more prominently) the potential introduction of a virus or other malicious code in the exchange of data between two organizations through the simple commercial internet access each has to the others data.

Privacy Liability gets the most press since it deals with the liability to third parties as a result of the organization's failure to properly safeguard personally identifiable information or to safeguard information that is protected under a nondisclosure agreement. It is in Privacy Liability type instances where the crisis management benefit of any policy comes into play. No matter how experienced an organizations in-house public relations staff is, they may never have had to deal with the media crush that attends any well-known organizations loss of customer or employee personal information. Crisis management provides not only money but also services for the purposes of, ultimately, safeguarding the reputation of the organization through public relations activities.

 

The concern for the property damage and third party liability associated with mold or fungus has been the focus of new insurance policy exclusions in recent years. Damage related to Exterior Insulation and Finish Systems (EIFS) i.e. synthetic stucco is a standard exclusion in all liability policies today.The deterioration of this building product has resulted in structural damage from moisture infiltration and growth of mold. In addition to this restriction most liability policies will also have a separate mold and fungus exclusion.

First party property policies are all being issued with similar mold and fungus exclusions. It would appear that everywhere you turn the insurance industry is finding another way to restrict coverage for this loss exposure.

 We often find the first generation of these type of "absolute exclusions" take away things that were never intended. Consider when the pollution exclusion in the general liability policy was introduced in the 1980's. The original version excluded injury as result of smoke from a hostile fire. A tenant in an apartment fire dies as result of smoke inhalation. The apartment owner has no insurance for the wrongful death lawsuit. This is a far cry from the underground tank leaking for several years, one of the primary causes for this exclusion. Now there is an exception for hostile fire, smoke, as well as the failure of heating, ventilating and cooling equipment.

We are finding that the same is true with the issue of mold. Let's assume you are a restaurant and patrons get ill alleging that food you served was spoiled. If you have the commonly used mold exclusion you will have no coverage for this type of an incident. Liability for the customer's illness is not covered by the general liability policy since it was the result of bacteria.  There is a version of this exclusion put out by ISO form CG 21 67 which has an exception for products that contain fungi or bacteria  intended for bodily  consumption. Like the good customer discount you have to ask for it and it is available.

 Now on to property. Let's assume your building sustains a fire and in the process of extinguishing it water infiltrates into the walls that you are unaware of at the time. You then learn weeks later that mold has grown in the walls and need to be remediated. A  policy with the typical biological agents exclusion would provide no coverage for cleanup with my example. It is only logical if an insurer covers a loss due to an insured peril they should also cover all  the resulting damage. Some property insurers are willing to extend coverage for mold damage that results from a covered peril often with a sublimit. Some coverage for mold is better than none at all.

Now one would think that if you purchased a separate pollution liability policy you would automatically have coverage for mold damage. This is not the case since most insurers attach a mold exclusion in their standard policy. Usually, a mold coverage extension can be negotiated with the insurer which will usually have a separate sublimit and deductible. Here again some coverage is better than none.

The message here is watch for mold limitations in your insurance policies. There are circumstances where coverage carve backs are available.

In Directors and Officers insurance it is well accepted that the “final adjudication” standard for so-called conduct exclusions trumps the “in fact” standard every time. Given a recent court decision, that dogma may no longer carry the same weight but it is still, with some modification, the preferred policy language.

Conduct exclusions are typically of two types, criminal or fraudulent acts and personal profit, remuneration or advantage (and not always confined to financial advantage) to which the Insured is not entitled.

Most standard policies make an exception to these exclusions to the extent that such conduct is determined “in fact” to have occurred or that a “final adjudication” has determined that such conduct has taken place.  Other policies will split the standard, applying “in fact” to personal profit and “final adjudication” to criminal acts. Still other policies (constructed in multiple sections covering Directors and Officers, Employment Practices and Fiduciary Liability) apply different standards to different coverage parts. It is important then to determine what’s what and where.

Dispensing with the quotations around these terms, the in fact standard was generally assumed to mean that the insurance company would evaluate the available evidence and make the determination of whether the conduct alleged in fact had taken place. If so, and at that point, all coverage (primarily but not exclusively defense) would be withdrawn. This made sense to the insurance company as they were then able to control the provision of coverage without relying on the more costly and time consuming process of a court's final adjudication on the merits of the underlying case.

In Pendergest-Holt v. Certain Underwriters at Lloyd’s of London, Case No. 10-20069, decided on March 15, 2010, the Fifth Circuit declared that “absent language unambiguously pointing to the (insurance company) as the decision-maker, the policy language“ determined….”in fact” necessitates a “judicial act” before the insurance company can rely on the exclusion.

 Although the case cited involved money-laundering allegations and either a public or private company D&O policy form, the same conduct exclusion language appears in not-for-profit D&O forms as well.

Of note is the fact that the Pendergest-Holt court did not conclude that this judicial determination would occur in the underlying (non coverage) action but in a separate contemporaneous coverage litigation.

All of that said, the policy language recommendation for conduct exclusions remains that the “in fact” standard is less useful (and more legally contentious) than the “final adjudication” standard. We would now add, as others have, that the final adjudication take place in the underlying action and that the adjudication be not merely final but final and non-appealable. This language should modify the conduct exclusions in separate D&O, EPL and Fiduciary polices or in all coverage parts of a management liability policy.

 

A February 14, 2011 article in Business Insurance discussed favorable changes in the market for public company Directors and Officers (“D&O”) liability insurance. What is even more pronounced, however, though less chronicled by main stream insurance publications, is availability of significant coverage enhancements for purchasers of Not-for-Profit (“NFP”) D&O insurance.

Because of the sheer number of such coverage enhancements, this is the first in a series of blog posts that will discuss what I consider to be the enhancements most useful to the typical buyer of NFP D&O. Along the way we will look at not only new coverages but also improvements to both existing coverages and other policy provisions. In the latter category, consider the so-called “hammer clause”.

Found typically in a Defense Costs, Settlements, Judgments (AIG) or Defense of Claims and Settlements (Starr) section of the policy, the hammer clause encourages the insured to agree to a settlement proposed by the insurer and acceptable to the claimant. In policy forms still being used, should the insured not agree to the settlement , the insured becomes responsible for 100% of all settlement amounts (often to include incremental defense costs) excess of the proposed settlement rejected by the insured.

Insurers, when challenged, lighten the hammer by agreeing to a 60/40 split; the insured assuming responsibility for only 40% of the amount excess of the proposed and rejected settlement. When still challenged, the hammer becomes just a bit lighter at 70/30 and, most prevalently, with 80/20 splits. All of these potential changes are, of course, subject to what an insurer is filed to offer in any jurisdiction.

Sometime around 18 months ago or so, insurers began removing the hammer clause altogether, although in policies with separate coverage parts for Employment Practices Liability (“EPL”) and Fiduciary Liability (“FL”), diligence is encouraged to ensure that the hammer does not apply to any  coverage parts and not just the D&O.

For the buyer of Not-for-Profit D&O/EPL/FL policies, first determine if the current policy contains a hammer clause of some weight (chances are it does) and if it does, call your agent or broker and ask why.

 

There is a commonly held misconception that multiple insurance brokers can secure property and casualty insurance from the same insurance company. While this may be common practice in the life and health world of insurance, not so with property and casualty.

Property and casualty insurance companies will only recognize the insurance broker who first provides it the submission; the door for any subsequent broker submissions is summarily closed. It follows then that the fastest and first to enter the marketplace has the best shot at writing the business by blocking markets and restricting competitors. This is particularly true if the first out of the box is the incumbent broker who floods the marketplace with submissions. Right about now this is sounding more like the 1889 Oklahoma Land Rush.

There is a way to establish some sanity in this process so you get the best results from the competitive process. First off, more is not always better. If you allow too many brokers to compete the "marketplace pie" will be cut up into smaller pieces, thereby limiting the negotiating abilities of each broker. This is because there may be only a limited number of insurers who are truly interested in that class or type of business.  The insured is best served by limiting the number of brokers to no more than three which will give each a reasonable selection of companies to choose from.

The next step is very important to avoid a marketplace “land rush”. Ask the chosen 2 or 3 brokers to submit a single list of desired markets they would like to approach by line of coverage and in order of preference listing their most preferred market first. You then assign in order of preference, resolving conflicts by who has the same insurer higher on their list. For instance, if Broker A has a very strong relationship with Travelers Insurance Co. and believes they will provide the best quote for your type of business.....it better be on the top or his or her list. The competing brokers will have no room to complain if they did not give Travelers the same relative importance. This process capitalizes on the strongest broker/company relationships and maintains that only one broker is approaching a given insurer.

It is important that this process start 90 days prior to the expiration of the insurance coverages being competed for. You should make certain that each broker is working with the same exposure information, such as property values, payroll, sales and list of automobile units (to name a few).  You next require that all proposals be submitted no later than 2 weeks prior to expiration. This gives you adequate time to evaluate the quotes and request modifications where needed. Oftentimes, a broker will respond that the underwriters will not furnish the quote by your deadline of 2 weeks before expiration. In these cases you can tell the broker his quote will not be considered, which provides a strong incentive to meet the deadline. You can always consider quotes after the due date if it is to your advantage.

While the handling of insurance is no picnic for any business today, instituting the above process will make it less painful and will most certainly improve the results of any bid process.

 

I am sure in the 1960's TV show Lost in Space, Will Robinson never envisioned that the Galaxy would suffer a greater threat from cyber hackers than asteroids. Most businesses today are not insured for the criminal risk of unauthorized access to their network systems. These uninvited guests no longer just cause a minor disruption or annoyance. According to the Ponemon Institute study of 2009, the average cost of a data breach globally is over $3 million. Some of the costs incurred are system damage, recovery costs and lost business due to business disruption, as well as negative publicity that results. The focus in this article is the necessary costs associated with notification and credit monitoring for those affected. There are insurance products in the marketplace designed to address cyber liability, but until recently there has been minimal interest.

What has been learned in recent years is that theft and fraudulent use of personal information is not always the major cost of a breach in security. If a corporate database is infiltrated by an outsider, there is the potential infection of personal data that is stored, financial and credit card information of customers and social security numbers of employees. When this occurs, there is a need for individual notification to anyone who may be exposed to the breach.There are over 40 states now that have legislated notification requirements for security breaches and more stringent  federal guidelines are expected in the future. 

According to the Ponemon study, the actual cost for individual notification and credit monitoring is in excess of $200. On an individual basis, this may not appear to be that catastrophic. However, consider the need to notify 10,000 customers of possible compromised access to credit/debit cards coupled with post-breach credit monitoring.  We are now talking about costs in excess of $2 million. This is just the “damage control” expense side of the breach and does not begin to address any third party litigation that may follow.

 

These remediation costs, along with any regulatory fines or penalties, have been an area where most insurers offer minimal limits of coverage. Today, more insurers realize that these costs are the major focus and need for this insurance. Darwin Insurance and Allied World Insurance now extend this coverage up to full policy limits, which also includes regulatory fines or penalties. It is clear this coverage continues to evolve in line with legislative changes and a better understanding of the exposure to loss.

 

It would be wise for any business responsible for personal information -- credit information, social security numbers or medical data -- to evaluate the need for this insurance. In the words of the Robot, “Danger, danger Will Robinson!”. It is best to be aware of the dangers associated with cyber business risks even if you don’t buy the insurance.

 

Tags:

Continuing in the theme of Steve's recent Blog on deductibles prompts me to think "When should you increase them?"  This is a question most insurance buyers will ask their insurance broker at some point and the answer should always be......"it depends".

You cannot begin to evaluate a deductible change (either up or down) without understanding the attendant cost/benefit relationship. Obviously, you would expect to get a reduction in premium if you raise the deductible, but with this benefit will come the potential cost of an increase in uninsured losses.

Let's consider an example. A large shopping center currently has a $1,000 deductible under its Commercial General Liability policy, due to the frequency of slip and fall claims that generate medical costs. With the ever-increasing cost of medical care, the shopping center is finding that many of these claims are creeping up to the level of $3,000 to $5,000.

The insurer is faced with the need to raise the premium for the coming year by 15% because they believe these claims will continue to escalate. The policyholder considers this an overreaction and does not agree claim costs will continue to rise. The insurance broker is suggesting that the deductible be raised to $10,000 for each loss occurrence or accident and believes that this will yield a measurable reduction in premium. Keep in mind that when discussing deductibles you will always want a per occurrence rather than a  per claim deductible. If two people are injured in the same event you don't want to pay a double deductible.

Both the owner and the broker have analyzed the historical claims and project the additional self- insured claims would be approximately $20,000. This assumes 8 claims $1,000 and under along with 2 claims that exceed $1,000. The insurer considers this an aggressive approach by the owner and is willing to reduce next year premium by $30,000. This means that if the broker and owner are right in their loss estimates the owner will benefit by $10,000.

Next, if we assume the loss estimates are wrong in one of next three years there will be a cushion of $30,000 over this period to pay for the unanticipated large claim or an increase in frequency. It is not expected there will be a frequency of severe claims, so the owner will not be faced with paying multiple $10,000 claims in a given year. In this example the owner is justified in taking on the additional risk based upon the projected savings.

This same process can be used when evaluating change on programs like Workers Compensation that typically have larger deductibles. The difficulty here is that moving from a $100,000 to a $250,000 deductible will not often provide the needed premium savings to justify the additional risk assumed. Usually, we see the impetus for change in this area to be forced by the insurer due to loss penetration in the insured layer. Logically, there then should be some reasonable premium reduction since some of the expected losses will fall back into the self-insured layer. Retentions at this level put greater responsibility on the insured to prevent and control claims, because at a $250,000 deductible most if not all claims will be self paid. Unfortunately, the premium negotiations here are most productive after several years of additional experience where all claims are retained under the deductible. Here, the insurer will be forced to reduce the future premiums to reflect this favorable experience.

Finally, another important factor when considering deductibles or retention levels is management's attitude towards risk. Some businesses have an aggressive posture, while others are conservative and risk averse as a corporate personality. A  business that is conservative by nature will be less likely to look at higher retentions, even when analytics supports the decision.

Whenever considering the cost benefit of changing retentions it is best to follow the tried and true insurance maxim of "Don't Risk a Lot for a Little".

Deductibles Are Not Created Equal

The term "deductible" in insurance circles is too often treated generically.  It is widely considered to be the amount that an adjusted claim is reduced by to arrive at a net insurance recovery.  In reality, deductibles can and do operate in many different ways.

Let's consider a Commercial General Liability ("CGL") policy.  There are several different ways of structuring a deductible arrangement.  The stated deductible may apply per "occurrence" or per "claim"; to damages only; to damages including allocated expenses; to damages plus allocated expenses; to damages plus a pro-rated share of "allocated expenses"; to bodily injury ("BI") alone; to property damage ("PD") alone; to BI and PD combined; and well, the list goes on and on.

An example may help illustrate the differences of how deductibles are applied.  Walsh Industries manufactures fans for residential use and has a CGL policy with Stucker Insurance Co.  One of its fans malfunctions and causes a fire at a residence.  Two guests at the home suffer bodily injuries and the home is completely destroyed.  Walsh Industries settles the first bodily injury claim at $100,000 and incurs $60,000 of legal expenses.  It settles the remaining bodily injury claim at $250,000 and has $80,000 of legal expenses.  It settles the home owner's claim at $500,000 and legal expenses amount to $40,000.  Walsh Industries has a $50,000 deductible under its CGL policy.  But the devil is in the details.  Here is how it comes out for the policyholder:

 

 If the deductible applies:   Then the deductible is:
 Per claim for damages and allocated expenses combined

               $ 150,000

 Per claim for damages plus all allocated expenses                $ 330,000
 Per claim for damages plus pro-rated allocated expenses                $ 181,765
 Per occurrence for damages and allocated expenses combined                $   50,000
 Per occurrence for damages plus all allocated expenses                $ 230,000
 Per occurrence for damages plus pro-rated allocated expenses                $   60,588

 

Obviously there are other combinations if the deductibles apply to BI and PD claims separately or combined.  However, the point is that the ultimate deductible amount varies considerably depending on how the deductible amount is applied

It should also be kept in mind that insurers use differing wordings in deductible clauses and endorsements.  So the next time an insurer or broker/agent says the deductible is "X", say "tell me more about that....."

Kidnap and Ransom (K&R) insurance policies typically indemnify the policyholder for the costs involved in the evacuation or relocation of  insured persons in the event of:

  • The insured person being declared "persona non grata" by the recognized government of the host country;
  • The wholesale seizure, confiscation or expropriation of property of the named insured;
  • Political or military events involving a host country which causes appropriate authority to issue an advisory.

For non-political or medical evacuation, most Travel Accident and Foreign Workers' Compensation policies would respond.

But what happens when an insured person simply goes missing? Or when when one or more insured persons sense a threat to their personal safety although no specific threats (or advisories) have been made against such persons? In our experience, few K&R policies will respond.

Recently, though, we came across two K&R endorsements that offer insureds the prospect of at least conditional coverage in these instances. We also found an endorsement that fits between kidnapping and hijacking creating a new coverage, "Express Kidnapping".

We offer these not as ready-made endorsements but rather to provide endorsement language that a broker could take to a K&R underwriter in an effort to get such language adapted to that underwriter's K&R form.

  1. Disappearance Expense Extension Endorsement pays for the cost of investigation and "other relevant expenses" resulting from the disappearance of an insured person, missing for at least 48 hours, with such expenses not to exceed 90 days. Here, $100,000 of such insurance limits are offered. Page 2 of the endorsement is a signature page and is omitted.
  2. Evacuation or Repatriation Costs Endorsement appears to be a standard endorsement of this type. However, the definition of "Occurrence" holds the key to an unusual coverage. On the top of Page 2, item 4. "occurrence" is defined to include a request for evacuation based upon the contingencies cited at the top of this post, but without the issuance of an advisory. In other words, if an insured person feels exposed to any of these three contingencies and requests evacuation, such request can be granted by the insurer's K&R consultant. Here, the limits of insurance are modest, but at least the door is now open and limits negotiations can take place between the insured and the insurer.
  3. Express Kidnap Extension Endorsement is a variation on both hijacking and kidnapping. The typical hijacking definition is triggered by a holding of an insured person under duress for a period of at least 6 hours while traveling on any aircraft, motor vehicle or waterborne vessel.

Kidnapping is defined to mean the seizing, detaining or carrying away by force or fraud for the purpose of demanding ransom monies.

This endorsement creates a new coverage term, Express Kidnapping, defined as the hijack of an insured person for a period of less than 4 hours while traveling in a motor vehicle. Page 2 of the endorsement is a signature page and it is omitted.

Most business interruption policy forms will include extra expense coverage to the degree it reduces the business interruption loss. One might think that with this built in coverage there is no need for additional extra expense coverage. Not so. Let's assume a retailer has a fire and incurs cost to temporarily lease another location and for additional advertising expenses. When it comes time to settle the business interruption loss with the insurance adjustor (read  forensic accountant here), he will look at subsequent sales when the retailer is back in business. If sales increased by 10% due to an improved economy, the case will be made that the retailer made up the lost sales thereby disallowing the extra expense incurred because it did not reduce the loss of income.

Chip Merlin makes the point that the adjustment of these losses needs to be much more prompt. Many business interruption claims are not settled until well after the policyholder has returned to business. The accountants drag this out, often to be sure the lost income or sales was not made up in subsequent months. One measure to circumvent this delay is to purchase pure extra expense coverage that will apply whether or not the cost incurred reduces the business interruption loss. These expenses should be reimbursed by the insurer up front as they are incurred, because there is no need to validate that the costs help reduce the BI loss.

How much coverage to buy? Always a tough question. We have developed a user friendly worksheet to assist in determining the types of expenses that could be incurred after a loss. Since this is always a calculated estimate it is best to be conservative in establishing the limit. It is inexpensive insurance and it is always better to have too much rather than not enough. In recent years a new term, "demand surge" has evolved out of major catastrophes such as tornadoes, hurricanes and earthquakes. This relates to the increased cost of materials and supplies when a catastrophic event spikes the demand.  Generators, temporary phone lines and computer equipment may cost well in excess of your estimate in these situations. I guess this is why it is best to buy a snow blower in July rather than January.

The moral of the story is be sure you have more than adequate Extra Expense coverage so you can get back in business in the most expeditious manner. The longer the delay the greater the chance that resumption will never occur.

Tags: