This is Why You Should Double Check Your Cyber Insurance Policy

Image

Whether a business is in healthcare, accounting, legal, real estate, manufacturing, etc., most of a business’ important assets are digital. (Government municipalities are included too.) To make matters complicated, it’s very common for these digital assets to be stored in various systems and locations, intertwined with a third party’s digital information. With so many opportunities for disaster, steps must be taken to insure this critical information.

Cyber insurance is a new frontier that is rapidly evolving as the industry gets its bearings. Many companies are finding that their current cyber policies have very minimal coverage in case of a cyber breach, and the majority of these policies will not come close to providing the necessary breach coverages to the business or municipality.

When looking at your existing or new cyber policy, it’s important to consider these types of coverages:


As we have come to realize, the idea that security starts and ends with the purchase of a pre-packed firewall is simply misguided

Art Wittman

1. Privacy Breach Notification

Some reports estimate the notification and credit monitoring costs alone are over $100 per record, so if you had 1,000 compromised records, this alone could cost $100,000 or more.

2.Data Loss Restoration

Believe it or not, many large insurance carriers have policy exclusions for the replacement and restoration of data, so be very careful in this area when reviewing your policy.

3. Privacy Liability

This covers for the theft or loss of private information related to customers and other third-party information that is in your care.

4. Regulatory and PCI Defense

Many industries are under strict regulatory control, and breaches may result in fines and other penalties from these regulatory agencies.

5. Public Relations

If an enterprise has a breach, the bad press they receive can do significant long term reputational damage and can also be used by competitors to their advantage. This coverage will help hire a public relations firm to mitigate the reputational damage your name brand might incur.

6. Cyber Crime

If your organization is threatened with various cyber threats such as malicious code that will result in financial loss or data loss, this coverage is needed for the reimbursement of the costs associated with these threats.

7. Defense and Settlement costs

A breach affecting a lot of customers may result in lawsuits and financial settlements, so insurance coverage is needed to offset these potentially enormous costs.

8. Consulting and Forensic Fees

If a breach does occur, the upfront investigative process will require a lot of professional expertise and a lot of money, and this specific coverage will offset these significant costs.

9. Business Continuity

If a hack causes your business to lose income, this coverage will reimburse you for these losses.

It takes 20 years to build a brand or company reputation and a few minutes within a cyber incident to ruin it

Stephane Nappo

For a free cyber insurance policy evaluation, contact Libertate Insurance today at 813-367-7574 or email me, James Buscarini at jbuscarini@libertateins.com.

Our professionals are happy to review and discuss your firm’s existing cyber liability insurance policy and the relation to your unique business requirements, needs and cyber coverage. Our goal is to help your PEO and client companies navigate the cyber liability insurance landscape and identify potential vulnerabilities that could be exposed based on your existing technology network and infrastructure. Finally, we want to make sure that in the event of a ransomware attack, business email compromise or phishing expedition your firm has adequate coverage in each of the areas that you might be vulnerable to be targeted in.

CYBER RISKS & LIABILITIES – Penetration Testing Explained

Image

Keeping workplace technology up and running is vital to any organization’s success. While this task seems feasible, it’s growing harder and harder each year as cybercriminals expand their reach.  It’s not enough to simply protect workplace technology with software and security protocols. It’s also critical for your organization to test the overall effectiveness of these protocols on a regular basis. That’s where penetration testing can help.

Essentially, penetration testing consists of an IT professional mimicking the actions of a malicious cybercriminal to determine whether an organization’s workplace technology possesses any vulnerabilities and can withstand their attack efforts. Conducting a penetration test can help your organization review the effectiveness of workplace cybersecurity measures, identify the most likely avenues for a cyberattack and better understand potential weaknesses.

Review this guidance to learn more about what penetration testing is, the benefits of such testing and best practices for carrying out a successful test within your organization.

What Is Penetration Testing?


Put simply, penetration testing refers to the simulation of an actual cyberattack to analyze an organization’s cybersecurity strengths and weaknesses. This testing usually targets a specific type of workplace technology, such as the organization’s network(s), website, applications, software, security systems or physical assets (e.g., computers and smart devices). Penetration testing can leverage various attack methods, including malware, social engineering, password cracking and network hacking, among others. Generally speaking, penetration testing is often performed by a professional from a contracted IT firm who is not associated with the organization being assessed in any way. This helps the cyberattack simulation seem as authentic as possible. Penetration testing is typically either external or internal in nature. The primary differences between these forms of testing are as follows:

  • External penetration testing requires the IT expert to attack an organization’s external-facing workplace technology from an outside perspective. In most cases, the IT professional won’t even be permitted to enter the organization’s physical establishment during external penetration testing. Rather, they must execute the cyberattack remotely—often from a vehicle or building nearby—to imitate the methods of an actual cybercriminal.
  • Internal penetration testing allows the IT expert to attack an organization’s internal-facing workplace technology from an inside perspective. This form of testing can help the organization understand the amount of damage that an aggrieved employee could potentially inflict through a cyberattack. 

In addition to these testing formats, there are also two distinct types of penetration tests. How much information an organization provides the IT professional prior to the cyberattack simulation will determine the penetration test type. Specifically:

  • An open-box test occurs when the IT expert is given some details regarding the organization’s workplace technology or cybersecurity protocols before launching the attack.
  • A closed-box test occurs when the IT expert is provided with no details other than the organization’s name before conducting the attack.

Ultimately, the penetration testing format and type should be selected based on the particular workplace technology elements or cybersecurity measures that an organization is looking to evaluate.


Benefits of Penetration Testing

Penetration testing can offer numerous advantages to your organization, including:

  • Improved cybersecurity evaluations—By simulating realistic cyberattack situations, penetration testing can help your organization more accurately evaluate its varying security strengths and weaknesses—as well as reveal the true costs and of any security concerns.
  • Greater detection of potential vulnerabilities—If any of your workplace technology or other cybersecurity protocols fail during a penetration test, you will have a clearer picture of where your organization is most vulnerable. You can then use this information to rectify any security gaps or invest further in certain cyber initiatives.
  • Increased compliance capabilities—In some sectors, organizations are legally required to engage in penetration testing. For example, the Payment Card Industry Data Security Standard calls for organizations that accept or process payment transactions to execute routine penetration tests. As such, conducting these tests may help your organization remain compliant and uphold sector-specific expectations.
  • Bolstered cybersecurity awareness—Mimicking real-life cyberattack circumstances will highlight the value of having effective prevention measures in place for your employees, thus encouraging them to prioritize workplace cybersecurity protocols.

Penetration Testing Best Practices

Consider these top tips for executing a successful penetration test within your organization:

  • Establish goals. It’s crucial for you to decide what your organization’s goals are regarding the penetration test. In particular, be sure to ask:
  • What is my organization looking to gain or better understand from penetration testing?
  • Which cybersecurity threats and trends are currently most prevalent within my organization or industry? How can these threats and trends be applied to the penetration test?
  • What specific workplace technology elements or cybersecurity protocols will the penetration test target?
  • Select a trusted IT professional. Consult an experienced IT expert to assist your organization with the penetration test. Make sure to share your organization’s goals with the IT professional to help them understand how to best execute the test.
  • Have a plan. Before beginning the penetration test, work with the IT expert to create an appropriate plan. This plan should outline:
  • The general testing timeframe
  • Who will be made aware of the test
  • The test type and format
  • Which regulatory requirements (if any) must be satisfied through the test
  • The boundaries of the test (e.g., which cyberattack simulations can be utilized and what workplace technology can be targeted)
  • Document and review the results. Take detailed notes as the penetration test occurs and review test results with the IT expert. Look closely at which cybersecurity tactics were successful during the attack simulation and which measures fell short, as well as the consequences of these shortcomings. Ask the IT professional for suggestions on how to rectify security gaps properly.
  • Make changes as needed. Based on penetration test results, make any necessary adjustments to workplace technology or cybersecurity protocols. This may entail updating security software or revising workplace policies.
  • Follow a schedule. Conduct penetration testing at least once every year, as well as after implementing any new workplace technology.

If you are a Risk Manager or Principal of a PEO and want to learn how you could help protect your client company’s interests through our affordable Master Cyber Liability program, eMail James Buscarini, Fl License #A036520 at jbuscarini@libertateins.com to find out more. The Master Cyber program is written through Axis, an A rated carrier, 250K in coverage, no underwriting, and a revenue generator!

White House Issues Ransomware Prevention Guidance to Businesses

In a recent letter addressed to corporate executives and business leaders, the White House emphasized that
bolstering the nation’s resilience against cyberattacks is a main priority for President Joe Biden’s administration.
Specifically, as ransomware attacks continue to rise in both cost and frequency throughout the country, the
federal government is urging businesses to take this evolving cyber threat seriously.

These attacks—which entail a cybercriminal deploying malicious software to compromise a business’s network or
sensitive data and demand a large payment be made before restoring this technology or information—have
quickly become a growing concern across industry lines. In fact, the latest research provides that ransomware
attacks have increased by nearly 150% in the past year alone, with the median ransom payment demand
totaling $178,000 and the average overall loss from such an attack exceeding $1 million.

While the White House has begun working with both domestic and international partners on various strategies to
prevent ransomware attacks, the Biden administration is also encouraging businesses to play their part in
minimizing this rising cyber concern. Rather than viewing ransomware attacks as a minor cyber risk, the federal
government is instructing businesses to view these attacks as a significant exposure—one with the potential to
wreak havoc on their key operations.

As such, the Biden administration is recommending that businesses convene with their senior leadership teams
to review their ransomware exposures and implement these top cybersecurity measures:


  • Utilize the federal government’s best practices. Businesses should be sure to incorporate the best
    practices outlined in the Biden administration’s Executive Order on Improving the Nation’s Cybersecurity. This
    includes the following practices:
    o Implementing multi-factor (MFT) authentication on all workplace technology
    o Leveraging endpoint detection and response tools to identify and deter suspicious network activity
    o Encrypting sensitive data to make it less accessible to cybercriminals
    o Developing a trusted and skilled workplace cybersecurity team
  • Ensure an effective incident response plan. All businesses should have cyber incident response plans in
    place. These plans outline proper response protocols and offer steps for minimizing potential damages during
    cyberattacks. Businesses should make sure to include several ransomware attack scenarios within their
    response plans and routinely test these scenarios with their cybersecurity teams. Based on test results,
    businesses should revise their response plans accordingly.
  • Conduct frequent data backups. In addition to the federal government’s best practices, businesses should
    also prioritize securely backing up all sensitive data, images and other important files on a regular basis.
    Conducting such backups can help businesses remain operational and continue to access crucial data in the
    event that any workplace technology is compromised in a ransomware attack. Data backups should remain
    offline (not connected to key business networks) and be routinely tested.
  • Keep critical networks separated. In order to keep ransomware attacks from fully disrupting their operations, businesses should attempt to segment their various workplace networks (e.g., sales production, and corporate) from one another rather than having a unified network. Access to each network should be restricted to those who use them to conduct their job tasks. Networks should only allow internet access as needed. That way, businesses can avoid becoming completely compromised by single-network ransomware attacks and continue performing critical functions.

  • Maintain updated security software. To help safeguard workplace technology from ransomware threats,
    businesses should equip their systems and devices with adequate security software—such as antivirus
    programs, firmware protections and firewalls. Further, this software must be regularly updated to remain
    effective. That being said, businesses should also consider utilizing centralized patch management systems to
    keep security software on a consistent update schedule.
  • Review workplace cyber security protocols. Apart from testing their response plans, businesses should
    also regularly assess whether their existing workplace cybersecurity policies, procedures and software are
    sufficient in protecting against current risks—such as ransomware threats. In particular, businesses should
    consider using a third-party penetration tester to review their ransomware defense tactics and overall
    cybersecurity capabilities. Businesses should work with their trusted cybersecurity teams and IT experts to
    make workplace adjustments as needed (e.g., updating policies or purchasing new security software).

For additional risk management guidance and insurance solutions email me James Buscarini, PCA at jbuscarini@libertateins.com or call me at 813.367.7574.

The Week in Review

We hope you had time this week to review some great posts by Paul Hughes and James Buscarini. 

On Tuesday, James shared with us some great tips on how smaller employers can attract and retain talent when competing with larger firms.  Check out his post on 6 Benefits to Attract and Retain Small Business Employees.    

On Thursday, Paul reminded us of the ongoing trends which are playing out in the realm of cyber Insurance.  According to content sourced from AM Best, we are witnessing an increase in both frequency of events as well as average cost per event in the cyber space.  This trend will, no doubt, bring about not only marked increases in cyber insurance premiums, but more rigorous requirements in cyber security by carriers willing to continue offering products in this space.  For full details, check out his post Annual Growth of Cyber Claims is Double Growth of Cyber Premiums.  

On this day, June 11th in 1776 the Continental Congress created a committee to draft a Declaration of Independence with Thomas Jefferson, John Adams, Benjamin Franklin, Roger Sherman, and Robert R. Livingston as members.  Thomas Jefferson primarily penned the original draft which was dived into five sections, including an introduction, a preamble, a body (divided into two sections) and a conclusion.  While the body of the document outlined a list of grievances against the British crown, the preamble includes its most famous passage: “We hold these truths to be self-evident; that all men are created equal; that they are endowed by their Creator with certain inalienable rights; that among these are life, liberty and the pursuit of happiness; that to secure these rights, governments are instituted among men, deriving their just powers from the consent of the governed.”

The Continental Congress reconvened on July 1.  The process of consideration and revision of Jefferson’s declaration continued on July 3 and into the late morning of July 4, during which Congress deleted and revised some one-fifth of its text. The delegates made no changes to that key preamble, however, and the basic document remained Jefferson’s words. Congress officially adopted the Declaration of Independence later on the Fourth of July (though most historians now accept that the document was not signed until August 2).

What would Thomas Jefferson think of our cyber insurance woes of today?

Happy Friday everyone!! 

Annual Growth of Cyber Claims is Double Growth of Cyber Premiums

Time For Insurers to Reassess ‘Grim’ Cyber Insurance Market: AM Best

It comes as no secret that there has been an increase in both cyber events as well as the average cost per event. This escalation seems to be fueled by the ever-increasing volume of ransomware attacks. A few fun facts from the below article from our friends at Carrier Management, citing AM Best as a source.

  • Year over year loss ratio went up 551% from 44.8% to 67.8%. 15 of the top 20 cyber insurers saw deteriorating results (9 of top 10)
  • Industry stalwarts CNA, AIG, XL and Travelers got hit especially hard on this line
  • Defense and cost containment costs (the cost to contain claims like attorneys and forensic experts) are going to be substantial due to nature and sophistication of claims; prediction of costs uncertain based on lack of historical data to support it
  • Cyber claims number of claims is up 18%, strictly due the surge in first party ransomware. Ransomware was up 35% and now accounts for 75% of all cyber claims

Needless to say, pay attention to the market if you already buy this coverage as it is quickly shifting. Critical focus should be given on ransomware limits, deductibles and responsiveness due to significant amount of overall exposure this type of attack can bring.

___________________________

With the cyber risk hazard environment—ransomware, business interruption and aggregation—worsening significantly, “prospects for the U.S. cyber insurance market are grim,” according to a report from AM Best.

According to the global rating agency’s analysts, insurers “urgently need to reassess all aspects of their cyber risk, including their appetite, risk controls, modeling, stress testing and pricing, to remain a viable long-term partner dealing with cyber risk.”

The reassessment is needed because cyber insurance, which began as a diversifying, secondary line and another endorsement on policies, is now a “primary component of a corporation’s risk management and insurance purchasing decisions,” notes Best’s in its report, “Ransomware and Aggregation Issues Call for New Approaches to Cyber Risk.”

The loss ratio for cyber insurance rose dramatically in 2020, to 67.8 percent from 44.8 percent in 2019. However, the increase was not limited to just a few insurers—the loss ratio rose for 15 of the 20 largest cyber insurers, AM Best reports.

“The rate increases for cyber insurance outpaced that of the broader property/casualty industry, but the increase in cyber losses outstripped the rate hikes, which suggests more trouble for 2021 as ransom demands continue to grow,” said Sridhar Manyem, director, industry research and analytics.

Of special note, defense and cost containment (DCC) expenses are rising and “could become a significant issue because of potentially significant costs to defend claims as a result of either ambiguous coverage language or regulatory investigations that may involve defense costs,” the report adds.

According to the report, the challenges the cyber insurance market are facing include:

  • Rapid growth in exposure without adequate underwriting controls;
  • The growing sophistication of cyber criminals that have exploited malware and cyber vulnerabilities faster than companies that may have been late in protecting themselves; and
  • The far-reaching implications of the cascading effects of cyber risks and the lack of geographic or commercial boundaries.

See related article, “Federal Lawmakers Probe CNA, Cyber Insurance Payouts,” for a loss ratio ranking of the top 10 U.S. cyber insurers.

Direct written premiums for cyber insurance grew 22 percent in 2020, to $2.7 billion, which AM Best attributes to increases in both rates and demand for cyber insurance in the wake of well-known firms such as SolarWinds, Facebook and Capital One becoming victims. The average annual growth rate in premium has been 20 percent the past four years , while the average growth in claims has been 39.2 percent.

“Rapid growth is viewed with a healthy skepticism, as it comes with underwriting and reserving risks,” the authors comment.

Standalone cyber insurance policies, up 28 percent in 2020, have seen a higher rate of growth compared with packaged policies, which the report indicates signal organizations’ escalating concerns about cyber risk. Frequency on standalone policies also has increased faster than for packaged policies the last three years.

Hackers are becoming more sophisticated in their attacks and moving toward larger targets. The report also notes that hackers’ motives also appear to be changing as well, from stealing identities (third-party claims) to shutting down systems for ransom (first-party claims).

Total claims rose 18 percent in 2020 owing strictly to first-party ransomware claims, which were up 35 percent in 2020 and now account for 75 percent of cyber claims.

“The recent Colonial Pipeline hack—for a multi-million dollar ransom—is an example of first-party claims that have become so prevalent,” said Christopher Graham, senior industry analyst, AM Best.

Although AM Best said it views the industry as being well-capitalized, it also warns that individual insurers that venture into cyber risk without a thorough understanding of the market can find themselves in a vulnerable situation.

Noting that the industry has not yet faced a systemic event that challenges traditional underwriting categories of region, industry, size, the authors urge insurers to hire experts to help with mitigation and to take steps to improve their abilities to quantify their exposure and define their risk appetites.

“An insurer whose risk management approach is deficient can find itself subject to accumulation risk beyond its tolerance and could face ratings pressure,” said Fred Eslami, associate director, AM Best.

SourceRansomware and Aggregation Issues Call for New Approaches to Cyber Risk – AM Best

BUSINESS INSIGHTS

Brought to you by the insurance professionals at Libertate Insurance Services



6 Benefits to Attract and Retain Small Business Employees

Attracting and retaining employees is a constant struggle for organizations of any size, but it’s particularly so for small businesses. With smaller teams, employers need to hold onto talent whenever possible. And that can be a challenge, especially when resources are scarce as they are currently amid the lingering effects of the COVID-19 pandemic.

That’s why it’s critical for small employers to tailor their benefits offerings in a way that attracts and retains the most employees. One of the best ways to start this process is by surveying existing and potential employees. Employers can ask workers what types of benefits would interest them the most, then use that data to inform benefits decisions.

While each workforce will have unique needs and interests, there are some commonalities seen among small business employees. This article outlines six of the most popular benefits that small businesses are using to attract and retain employees.

1. Health Insurance

2. Leave Benefits

3. Performance Bonuses

4. Retirement Planning

5. Professional Development

6. Wellness Benefits

Health insurance – is consistently one of the most desired benefits among small business employees. That may be because healthcare is so expensive and is unaffordable without employer-sponsored insurance. Amid the COVID-19 pandemic, having good health coverage is more critical than ever. This provides employers with an opportunity. By offering generous health benefits, employers can compete for top talent. In fact, doubling down on health insurance might be a better option for some employers than adding other ancillary benefits that employees don’t need or want.

2. Leave Benefits – The ability to take time away from work is an important consideration for employees. And, in the wake of the COVID-19 pandemic, employees may have more caregiving responsibilities than they had before—making scheduling flexibility all the more important. Leave benefits will vary by workplace, but they typically include paid time off (PTO), vacation days and sick time. These types of leave usually come with specific use requirements. For employers looking to attract and retain employees, expanding these benefits could be a great leverage tool. This may include allowing faster PTO accrual, providing more sick days or allowing for flexible scheduling.

3. Performance Bonuses – Employees want to be recognized for their hard work. Failing to do so can lower morale and affect retention. Introducing performance bonuses as an employee benefit can be a way to combat this. Performance bonuses will vary, but the general idea is to compensate employees in some way for a job well done. How this looks in practice will depend on the employer. For instance, employees might receive incentives such as gift cards, cash, additional PTO or other perks, depending on their achievement. However, before implementing such bonuses, employers should ensure compliance with any applicable workplace laws regarding employee compensation.

4. Retirement Planning – Financial security is very important to employees, and that sentiment grows as employees near retirement age. It’s also top of mind for those struggling financially thanks to the COVID-19 pandemic. Employees invest their time and energy into their work. As a tradeoff, many employees want their employers to invest in their retirements in return for years of service. Offering a 401(k) with contribution matching can be a powerful attraction and retention tool, as it demonstrates an employer’s investment in their workers in the long term. 

5. Professional Development – Employees may leave a workplace simply because they want other opportunities or need more of a challenge, rather than being driven solely by compensation. Additionally, surveys suggest employees have been putting off job changes during the COVID-19 pandemic, meaning a wave of turnover may be coming soon. Employers may want to think proactively about ways to keep employees around.

In other words, when it comes to top performers, employers should be reluctant to let these employees go. That’s where professional development comes in. Generally, this involves cross-training employees on other positions or otherwise preparing them to take on additional responsibilities. This helps provide the employee with more growth opportunities while still keeping them within the business. Offering such development opportunities also signals to prospective employees that a workplace has upward mobility and is willing to help workers along with their career pathing goals—two factors that can weigh heavily in recruiting conversations.

6. Wellness Benefits – Wellness is a hot topic these days, and employees are looking more and more for employers who take wellness seriously. This can be especially true in the wake of the COVID-19 pandemic, where health consequences are interwoven with everyday decisions. In fact, through the lens of the pandemic, ignoring wellness initiatives may be interpreted as ignoring overall health—something employers obviously want to avoid.  

Different workplaces will offer different wellness benefits, but the purpose of any of them is generally to increase employees’ overall well-being. For instance, benefits may include mental health counseling, health breakroom snacks, gym memberships, fitness trackers, yoga sessions or other perks. When it comes down to it, employees want to feel like their employers care about them as individuals. This means prioritizing well-being.

“Everyone talks about building a relationship with your customer. I think you build one with your employees first.”

– Angela Ahrendts (Senior Vice President, Apple)

Conclusion

Knowing which employee benefits to offer as attraction and retention tools isn’t always easy. One of the best places to start is by surveying current and prospective employees, as the offerings are meant for them. Beyond that, the perks listed in this article have been shown to be popular among employees—making them a viable option to try as well.

However, these benefits aren’t employers’ only option to help attract and retain employees. Reach out to Libertate Insurance today to learn more about these perks and other potential incentives.

Benefits of Utilizing Post-Offer Medical Questionnaires in Your Hiring Practices

Prescient National produced this thought provoking look at how to effectively use Post-Offer Medical Questionnaires as a part of your hiring practices. The original post can be found by clicking here.

When companies think of managing their Workers’ Compensation costs, several key programs may come to mind. For example, Early Return to Work, Post-Accident Drug Testing, and establishing a network of medical providers have become second nature in the course of doing business.  While these post-claim activities will reduce costs after a claim has been filed, preventing a loss starts with strong hiring practices.

A comprehensive hiring program contains several standard components, such as pre-employment drug screening, criminal background checks, and reference checks. But perhaps none are more important than the Post-Offer Medical Questionnaire (POMQ). As health conditions, such as obesity, diabetes, and previous surgeries continue to contribute to Workers’ Compensation costs, employers who incorporate the POMQ can rest easy knowing they’ve taken every step necessary to ensure that employees can perform the essential functions of the job, without endangering themselves or others.

What is a POMQ and How Does it Mitigate Potential Injuries?

The POMQ is a document with questions about a prospective employee’s prior medical history.  The POMQ helps an employer understand if the individual will be able to complete the essential functions of the job with or without a reasonable accommodation. Its goal is to help match the candidate to the physical requirements of the job and prevent putting an employee in a job that could be unsafe for him or her, other employees, and the company. It’s good stewardship. 

Let’s use an example to illustrate:  An employer in the home healthcare industry employs nurses who travel from one home to another to provide care. The company conducts pre-employment drug screening, motor vehicle record checks, as well as criminal background checks and reference checks, but it does not use a POMQ as part of its hiring practices.  One day, while making a sandwich for a client, an employee bends over to pick up a piece of silverware that has fallen off the counter. When he stands up, he feels pain in his lower back and decides to file a Workers’ Compensation claim. When the claim is received by the insurance carrier, it is determined that the employee has had two prior back surgeries and that picking up the piece of silverware has aggravated his pre-existing back condition. After a doctor’s assessment, the employee is scheduled for a third back surgery, which will cost approximately $100,000. It is estimated that this claim alone will increase the employer’s experience modification rate from a 1.00 to a 1.50, which will cost the firm $500,000 in additional Workers’ Compensation premiums over the next three years. The employer was shocked to learn of the employee’s prior health condition and is frustrated that the employee cannot return to a “light duty” job, because the employee has been written completely out of work.  Additionally, the employer is worried that the employee was placed in a position that required lifting and walking assistance for an elderly client, and wonder about future lawsuits from “negligent hiring” practices.

In the example above, the employer could benefit greatly from the effective use of a POMQ.  Uncovering the prospective employee’s prior back surgeries would have allowed the employer to make a well-informed hiring decision, which would protect both the employee and its client population from injuries. For the POMQ to be “effective”, an employer must follow the rules of its use.

How to Use the POMQ

Under the Americans with Disabilities Act (ADA), employers are allowed to conduct medical inquiries of prospective employees as long as certain rules are followed. First, the document can only be used after a job offer has been made (i.e., “post-offer”), but before the employee is placed into the job. This means, for example, an employer cannot ask an applicant to complete a POMQ while filling out an application. Just as with background checks and drug tests, POMQs can also be part of the contingent post-offer process, but only if all new employees in the same job category are required to complete a POMQ.  All information on the POMQ is protected health information and must be handled responsibly (typically by HR), kept confidential, and secured separately. 

An applicant must be provided with a copy of the written job description that outlines the physical requirements of the job. The questions on the POMQ must be “job-related and consistent with business necessity.” This means that the job must contain physical exertion that has been documented and is essential. It also means that employers cannot inquire about any family medical history. The job description in our home healthcare scenario, for example, may require employees in the position to be able to lift 50 lbs. The POMQ will include a question related to the amount of weight an individual can comfortably lift unassisted. If the candidate is unable to meet this requirement, the employer will solicit a medical opinion and provide the doctor with a copy of the written job description. The candidate can meet with his or her own physician or with the company physician to determine if the job requirement can be met and what, if any, accommodations can be made to meet those requirements.  

Depending on the physician’s medical assessment, the employer (assisted by feedback from the candidate), must determine if the recommended “reasonable accommodation(s)” can be made to enable the candidate to meet the essential requirements of the job. This may involve modifying the job, if possible, or purchasing additional equipment to help with the task, depending on whether this is a reasonable expectation for the business to undertake. If no reasonable accommodation is available, an employer can withdraw the offer. 

POMQ Red Flags

There are certain red flags to look for in a POMQ. Ensure that every question on the POMQ is answered. Often, we see a candidate forget to complete a question or perhaps even refuse to answer a question. All questions should be addressed to avoid potential issues down the road. Look carefully to see if the candidate documents something that doesn’t match with the requirements of the job to address any discrepancies or potential problems. Also, make sure the document is signed by the candidate. 

Note: If a candidate is untruthful on the POMQ and aggravates a pre-existing injury on the job, in many states the claim may be denied. In most cases, the injury/aggravation must be to the same body part where he or she suffered a prior injury which was not disclosed. Typically, it must also be established that the employer would not have hired the employee if he or she had indeed disclosed the prior injury and the injury would not have allowed him or her to safely perform the essential functions of the job, with or without a reasonable accommodation.

At Prescient National, we believe that well-informed hiring decisions drive down costs and improve employers’ profitability. Used correctly, a POMQ is a good tool to optimize employee safety and to help mitigate potential claims. Hiring employees fit for duty is productive for the staff, insulates an employer from legal liability, and enhances safety throughout the organization.

Moody’s Says COVID Impact on Insurance was ‘Moderate’

Moody’s opinion echos that of NCCI regarding the impact of COVID on the Workers’ Compensation system. More rate decreases to come???

Neither COVID-19 nor legislation enacted because of it has seriously harmed the creditworthiness of the property and casualty insurance sector, according to a report released by Moody’s Investors Service on Friday.

Businesses have filed about 1,700 business-interruption claims because of COVID-19 shutdowns, but those cases are largely being decided in favor of insurers, Moody’s said.

“US property policies typically require direct physical loss or damage to the property for business interruption losses to be compensated,” Moody’s said. “Moreover, most policies specifically exclude coverage for losses caused by a virus or communicable disease.”

But the battle for coverage, of course, is far from over. Only 20% of the cases filed have been resolved so far.

“A handful of courts have recently ruled in favor of insured parties despite standard policy wordings,” the report says. “Additionally, court decisions are subject to appeal, a process that could take years to resolve.”

Moody’s says it believes that ultimately, policy provisions will limit insurers’ business-interruption losses is the United States.

Photo by Nick Fewings on Unsplash

“Nevertheless, we expect the ongoing litigation will lead to inconsistent outcomes, appeals to higher courts, elevated legal costs, and some uncertainty on this matter for the next couple of years,” the report says.

For workers’ compensation, which makes up 14% of commercial line P&C premiums, the coronavirus pandemic has had only a “moderate” impact on claim costs, the report says. Moody’s echoed a report by the National Council on Compensation Insurance released earlier this month that said total COVID-19 workers’ comp losses amounted to $260 million in the US.

“The severity of these claims was generally low with 95% of the claims less than $10,000,” Moody’s said. “With more states enacting presumption laws in 2021, insurers will see additional claims but we expect them to be moderate.”

While the passage of presumption laws led to more claims for work comp, state lawmakers also enacted laws that limit exposure for commercial liability. Moody’s said the coronavirus liability protection for businesses that was adopted by most states is a “credit positive” for insurers.

The report says eventually, government might step in to create a public-private risk sharing agreement to cover business interruptions caused by future pandemics. Moody’s said bills were introduced in a number of states last year that would have required insurers to pay COVID-19 business-interruption claims, but none passed.

“With an eye toward future pandemics, some insurers and US legislators are considering public-private risk sharing arrangements to compensate small and large businesses for business interruption caused by pandemics,” the report says. “Common elements of these proposals are that P&C insurers would administer the coverage and assume a limited portion of the risk, while the US government would assume the bulk of the risk.”