Embed Size (px)
Citation preview
Insurance for Social Service
Organizations
Ryan M. Keenan, CPCU, ASLI, ARe AVP, Sales & Marketing – The Keenan Agency
Michael H. Keenan, CPCU President – The Keenan Agency
Disclaimer
This presentation contains only a general description of coverages and does not include all of the benefits and limitations found in the policy. The insurance policy itself, not this presentation, will form the contract between the insured and the insurance company.
The Keenan Agency
• In business since 1938 • Located in Dublin, OH • Family owned and operated • Independent agency • We write Business, Home, Auto, Life &
Health • Represent 14 different insurance
companies • Website: www.keenanins.com
Vision Statement
The vision of The Keenan Agency is to be the most
knowledgeable insurance agency in the state of
Ohio. We will accomplish this by attracting and retaining
the best and brightest associates who seek to provide
every client with the foremost insurance protection
available. This also means fostering an environment
that promotes the most professional and respectful
working environment for all our clients and associates.
Our objective is to educate OACCA members on the
insurance coverages, terms and issues that are important
to a social service organization. We will discuss a variety
of different subjects which all will relate to structuring a
proper insurance program to adequately protect your
organizations.
Objective
•General Liability
•Abuse & Molestation
•Auto Liability
•Professional Liability
•Umbrella Liability
•Directors & Officers Liability
•Employment Practices
Liability
•Fiduciary Liability
•Crime Coverage
•Cyber Liability
Coverage Topics for Discussion
•General Discussion of Coverage Topics
•Claim Scenarios Designed to Illustrate What Can
Happen
•Question & Answer Throughout the Presentation
Format of Workshop
•Cincinnati (New Program Effective 10/1)
•Philadelphia
•Selective
•West Bend
Insurance Companies Who
Specialize in Social Services
What does General Liability cover?
• Coverage A: Bodily Injury or Property Damage which must be sudden and
accidental.
• Coverage B: Personal and Advertising Injury which includes false arrest,
malicious prosecution, wrongful eviction, libel, slander, use of another’s
advertising idea, copyright, trade dress or slogan infringement.
• Coverage C: Medical Payments which covers bodily injury regardless of
fault (usually a $5,000 or $10,000 limit).
General Liability (GL)
An elderly lady comes to pick up her grandchild at preschool. It is winter time,
and snow in the parking lot has been thawing and refreezing without being
treated. As she is walking through the parking lot, she slips and falls on some
ice breaking her hip. She is taken to the hospital, and her medical bills total
$97,000.
General Liability Claim Scenario
What does Abuse & Molestation cover?
•Physical Abuse, Mental Injury or Sexual Molestation from the negligent:
•Employment
•Investigation
•Supervision
•Reporting to the property authorities, or failure to so report; or
•Retention of any person for whom the insured is legally responsible
Abuse & Molestation
Does my policy cover an Abuse & Molestation incident?
• The only way to guarantee coverage is if it is affirmatively covered by
an endorsement to the general liability or a separate coverage part.
• If coverage is not affirmative, a carrier may cite the expected or
intended injury exclusion or the criminal acts exclusion of the general
liability.
A social service organization hired a new employee and performed a local and
state background check. Both background checks came back without any
criminal convictions. Several months later, it was discovered that a client of the
organization had been abused several times by the newly hired employee over
a period of several weeks. As a result of the investigation process, it was
discovered that the new employee had a criminal conviction for abuse in
another state. The organization was sued by the victim and their family for
$450,000 in damages.
Abuse & Molestation Claim
Scenario
What are some overlooked Auto Liability coverages?
• Even if your organization does not own any autos, you should consider these
coverages:
•Hired Auto Liability: Coverage for renting a vehicle in the course of your
business (allows you to waive liability coverage if a vehicle is rented in the
name of the business).
•Non-Owned Auto Liability: Coverage for an employee using their personal
vehicle.
•Hired Car Physical Damage: Coverage for physical damage to a vehicle
you rent in the course of your business.
Auto Liability
An employee with state minimum limits ($12,500 per person / $25,000 per
accident) uses their personal to run to the bank for the company owner. On the
way to the bank, the employee hits a bicyclist who is severely injured. A lawsuit
is filed against the employee’s personal auto insurance and during the course
of investigation, it is revealed that the employee was running an errand for the
company owner. After exhausting the employee’s personal auto liability limit of
$12,500, the employee’s company is sued for additional damages of $275,000.
Non-Owned Auto Liability Claim
Scenario
What does Professional Liability cover?
•Damages the insured becomes legally obligated to pay because of any act,
error or omission arising out of the insured’s professional activities.
Who needs Professional Liability?
•Professions that provide services requiring judgment, skill and advanced
education
The Scope of Services covered and the Definitions are VERY important to
determining whether coverage applies.
•For example, the scope of services in a Professional Counseling Liability
coverage form would be “Counseling”.
•“Counseling” is defined as professional guidance of the individual by utilizing
psychological methods especially in collecting case history data, using various
techniques of personal interview and/or testing interests and aptitudes,
directing another person’s conduct or course of life.
Professional Liability
Are all my employees covered?
•Not necessarily. Oftentimes, there are exclusions in Professional Liability
forms designed for social service organizations that exclude medical doctors,
psychiatrists, etc.
What’s the difference between a Claims Made and Occurrence coverage form?
•A Claims Made coverage form covers claims that are reported during the
policy period regardless of when they actually happen. Usually, there is a
retroactive date associated with a claims made policy that says the insurance
carrier will not cover claims that happened prior to the retroactive date.
•With an Occurrence coverage form, the policy that was in place when the
claim happened is the policy that will provide coverage.
*Note: You can switch from an Occurrence form to a Claims Made form without
any coverage problems but not vice versa. BE CAREFUL!
Professional Liability
A child under the care of a social service organization was given the wrong
medication and was taken to the hospital for treatment. The child’s parents
later sued the organization for damages and were awarded $175,000.
Professional Liability Loss
Scenario
What is the added value of an Umbrella Liability policy?
• Increased limits for catastrophe situations
• Umbrellas can stack over General Liability, Employers Liability, Employee
Benefits Liability, Auto Liability, Professional Liability (depending on the
professional exposure) and Abuse & Molestation (if the insurance carrier will
agree to do so)
• Umbrella carriers always require a minimum amount of underlying coverage,
such as $1M
How much Umbrella Liability should I carry?
• A good rule of thumb is at least an amount equal to the organizations assets
• More may be necessary depending on your specific circumstances
• Various organizations you work with may require higher limits
Umbrella Liability
The driver of a day care’s bus is distracted while driving and hits a 35 year old
surgeon standing on the street corner. The doctor is severely injured as a
result of the accident and is unable to perform the duties of his occupation any
longer. A jury awards the claimant $3.5M in damages for lost earnings and pain
and suffering.
Umbrella Liability Claim
Scenario
What is the purpose of a Directors & Officers Liability policy?
•To protect individual directors & officers from the personal liability associated
with the decisions they make for the organization
•To protect the organization from lawsuits
What is covered?
•Coverage is generally very broad under a Directors & Officers policy
•The insuring agreement will cover a Wrongful Act which is typically defined as
any error, misstatement, misleading statement, act, omission, neglect, breach
of duty, etc.
•Allegations such as breach of contract, unfair trade practices, consumer
protection violation, misrepresentation in the sale of a company, failure to
deliver services, regulatory actions and conflicts of interest.
Directors & Officers Liability
What are some key coverage concerns for Directors & Officers Liability?
•Limit of liability
•Shared or separate limits
•Defense coverage inside or outside the limit
•Definitions
•Exclusions
Directors & Officers Liability
ABC School and XYZ School decide it is in the best interest of both of them to
merge because of financial difficulties. After the merger, it was discovered that
ABC School misrepresented their financials prior to the merger. The board of
the newly formed school sued the former CFO of ABC School for
misrepresentation. ABC’s Directors & Officers policy provided coverage for the
CFO during the lawsuit. Total defense costs amounted to $84,000.
Directors & Officers Claim
Scenario
What does Employment Practices Liability cover?
•Discrimination (Race, religion, national origin, disability, etc.)
•Harassment (Sexual, hostile work environment, etc.)
•Retaliation
•Wrongful termination
•Breach of employment contract
•Third party discrimination and harassment (not always automatic)
Employment Practices Liability
An elderly employee is caught sleeping on the job. He is promptly terminated
by his manager. The former employee brings a suit alleging age discrimination.
Defense costs for the trial amount to $45,000.
Employment Practices Liability
Loss Scenario
When does the need for coverage arise?
•The Employee Retirement Income Security Act of 1974 created strict
standards for fiduciary conduct.
Who needs the coverage?
•Anyone who has a retirement plan for their employees.
•Plan trustees can be held personally liable as a fiduciary.
Fiduciary Liability
What types of allegations are made?
•Wrongful denial or improper change in benefits
•Error or omission in plan administration
•Improper advice or counsel
•Failure to follow plan documents
•Lack of diversity in investment options
•Failure to monitor third party service providers
Fiduciary Liability
A fiduciary is sued by a participant in the company’s 401K plan alleging that the
third party service provider they chose did not provide a broad diversification of
investment options to avoid losses. The company’s fiduciary liability policy paid
$22,000 to defend the fiduciary from the allegations.
Fiduciary Liability Loss Scenario
What does a crime policy cover?
•The main purpose is to protect the organization from theft by employees.
•In the digital age, some additional coverage parts, such as Computer Fraud
and Funds Transfer Fraud have been added to address emerging loss
exposures.
Crime Coverage
What does Computer Fraud cover?
•Use of a computer to fraudulently transfer covered property.
•Covered property includes money, securities, and other property.
•The property must be transferred from inside the insured’s premises or a
banking premise to a person or place somewhere else.
Source: CPCU Commercial Property Risk Management and Insurance
Crime Coverage
(Computer Fraud)
An organization’s website is was hacked by an employee of one of its clients.
The hacker changed the organization’s bank account and routing number so
that funds would go into the hacker’s account. $35,000 was stolen by the
hacker.
Crime Coverage
(Computer Fraud Loss Scenario)
What does Funds Transfer Fraud cover?
•Fraudulent instruction directing a financial institution to transfer, pay or deliver
funds.
•Money and securities are covered.
Source: CPCU Commercial Property Risk Management and Insurance
Crime Coverage
(Funds Transfer Fraud)
An organization received a fraudulent letter in the mail regarding a new security
procedure. Shortly thereafter, an email arrived that looked like it was from the
organization’s bank. When the email was opened, a trojan horse virus infected
the organization’s computer which allowed key strokes to be read. The creator
of the virus is then able to obtain the banking and password information to
request a fraudulent electronic wire transfer from the insured’s account. The
entire balance in the bank account ($125,000) was wiped out before the fraud
was discovered.
Crime Coverage
(Funds Transfer Fraud Loss Scenario)
Definition of Cyber Liability
•First party and third party risks associated with breaches of the insured’s
network security. These can include viruses, hacker attacks, lost or stolen
laptops, rogue employees, unauthorized disclosure of Personally Identifiable
Information (PII) or Protected Health Information (PHI) and related expenses to
satisfy regulatory response requirements.
Who has unauthorized access?*
•Hackers, employees, outsourcers and third party vendors
What are they accessing?*
•Laptops, computer networks, wireless networks, PDAs, cell phones, paper
files and websites
Traditional Property, Crime and Liability Policies Will Rarely Respond
*Source: SH Smith & Company, Evolving Liabilities: Cyber and Privacy Exposures
Cyber Liability
Cyber Liability Definition of Personally Identifiable Information (PII)
•As used in information security and data privacy laws, refers to information
that can be used to uniquely identify, contact or locate a single person or
can be used with other sources to uniquely identify a single individual. The
types of information normally associated with PII include: (at least three of
the following combined)
•Name and Address
•Date of Birth
•Social Security Number
•Credit Card Number
•Account Number/PIN or other financial account information
Source: Identity Theft Resource Center Data Breach Report 2009
Cyber Liability Definition of Protected Health Information
•HIPAA regulations define health information as “any information, whether
oral or recorded in any form or medium” that:
•“is created or received by a health care provider, health plan, public
health authority, employer, life insurer, school or university, or health
care clearinghouse” and
•“relates to the past, present or future physical or mental health or
condition of an individual; the provision of health care to an individual;
or the past, present or future payment for the provision of health care to
an individual.”
Source: Identity Theft Resource Center Data Breach Report 2009
Hi-Tech Act Notification Requirements in the Case of Breach
•Notification within 60 days for a privacy breach involving HIPAA covered PHI
•Notification to Health & Human Services and media outlets for breaches
involving 500 or more people
•Breaches less than 500 must still be logged with Health & Human Services
•State Attorney Generals can bring suits for HIPAA violations
Source: U.S. Department of Health & Human Resources
Cyber Liability
What is the cost of a Data Breach?
• Data Breach incidents cost companies $214 per compromised customer
record in 2010
•Indirect costs (loss of customers) accounted for $141 per record in 2010
•Direct costs (forensics, notification costs, credit monitoring, etc.) account for
$73 per record in 2010
Source: Ponemon Institute, LLC – “2010 Annual Study: Cost of a Data Breach”
Cyber Liability
Types of Cyber Losses
•First Party
•Expenses to notify affected parties
•Business income and extra expense
•Data restoration costs
•Extortion payments
•Crisis management
•Credit monitoring
Cyber Liability
Source: SH Smith & Company, Evolving Liabilities: Cyber and Privacy Exposures
Types of Cyber Losses
•Third Party (Liability)
•Failure to implement and maintain reasonable security procedures
•Negligence
•Unfair, deceptive, and unlawful business practices
•Invasion of the customer’s right to privacy
•Breach of contract and violation of Consumer Fraud Act
•Defense and damages
•Media/intellectual property
•Regulatory actions
Cyber Liability
Source: SH Smith & Company, Evolving Liabilities: Cyber and Privacy Exposures
Top Coverage Issues
•Notification costs/Crisis management limit
•Notification costs for states with breach laws only or voluntary notification
•Regulatory defense fines and penalties included and limits offered
•Public relations coverage included
•Forensic investigation coverage included
•Types of records covered – electronic/digital and paper records
•Dishonesty exclusion modified to include rogue employee coverage
•Failure to implement/maintain reasonable security standards exclusion
•Unencrypted portable devices exclusion
•Information covered when stored by third party vendors
•Type of data covered according to the definition
Cyber Liability
Source: SH Smith & Company, Evolving Liabilities: Cyber and Privacy Exposures
What would you do in the event of a breach?
•How would you figure out what information has been breached? (forensic
costs)
•How would you notify affected individuals? (different states have different
notification requirements)
•How would you pay for notification costs and credit monitoring?
•How would you answer questions individuals have about the breach? (call
center)
•How would you pay for the costs of a cyber attorney to defend lawsuits?
•How would you pay for the public relations costs to keep the goodwill of
your organization?
•How would you pay for regulatory fines and penalties?
Cyber Liability
An international hacking group gained access to the payment information of
2,000 current and former customers of a day care through their website
payment page. Client names, addresses and credit card information was
stolen and used to make fraudulent charges. Costs of the claim totaled
$146,000 in losses.
Cyber Liability Loss Scenario
A doctor at a child treatment organization had a laptop stolen out of her car that
contained the medical records of approximately 250 current and former
patients. Costs of forensics, notification, public relations, regulatory fines and
disclosure lawsuits totaled $450,000.
Cyber Liability Loss Scenario
An employee of a community action agency accidentally emailed the names,
addresses, social security numbers and dates of birth of current clients to
everyone on the agency’s email list. As a result of the human error, 700
records were compromised, which required notification and credit monitoring to
the affected individuals. The total cost of the human error to the agency was
$62,000.
Cyber Liability Loss Scenario
The head human resources person of a school takes home the health
insurance applications of some employees to organize them and catch up on
some work after hours. On the way home, he stops at the grocery store. While
in the store, his briefcase containing the applications is stolen out of his car.
One of the employees who had an embarrassing medical condition later sues
the school for reputational injury after the records are published on the internet.
The total judgment was $350,000.
Cyber Liability Loss Scenario
The key is to make sure your insurance program is providing you the coverage
you need to protect your organization as much as possible.
•Do you have adequate liability limits?
•Do you have abuse & molestation coverage?
•Is professional liability addressed in your insurance program?
•Do you have employment practices liability to protect you from
employment related suits?
•Does your employment practices coverage include 3rd party liability?
•Is your crime policy covering you for the exposures of a digital world?
•Have you looked into cyber liability exposures?
Conclusion
Ryan M. Keenan, CPCU, ASLI, ARe
Ph: 614-764-7000
Michael H. Keenan, CPCU
Ph: 614-764-7000
Thank You!
