What we will cover. Best Practices in Insurance and Risk Management. This session driven by pub revision. Publication goals:
|
|
- Brook Daniel
- 5 years ago
- Views:
Transcription
1 Best Practices in Insurance and Risk Management A Report on the Industry Insurance Research Project Jim Booth, Brightstone Consulting & Brightstone Insurance Bryan Paulozzi, Brightstone Insurance Services What we will cover Best Practices Property Coverage Comm Gen Liability Auto Worker s Compensation Warehouseman s Legal E&O and Privacy Other Insurance Survey Results Respondent demographics Policy comprehension Key concerns Coverage gaps Claims experience Common coverage General expense % This session driven by pub revision Publication goals: Ins. and Risk Transfer Guideline created in 2000 by Jane Bindas Was not revised to keep up with changes PRISM granted permission for BIS/BCS to provide a free revision of publication July Sept., 2012 Calls to PRISM members to collect policy samples Sept. Nov., 2012 Survey sent to all PRISM members with reminders Publication drafted and edited Dec., 2012 delivered to PRISM for review Create more comprehensive reference document for industry insurance Update document to recognize risks that have emerged in the last 12 years Establish some industry benchmarks Increase risk awareness and education among operators Finding #1 Classification NAICS/SIC classifications were many and varied Warehousing may no longer be accurate for multiple service line business Business Services NOC may not be accepted by underwriters Libraries & archives is accurate but inadequate Better classification needed Finding #2 Policy comprehension 45% have read policies and believe they understand them 28% have read their policies and understand them very well 1 in 4 respondents either had not read or did not understand their policies
2 Who responded? 16 policy samples & 36 survey responses
3 Who responded services offered
4 Who responded subcontracted svcs
5 Who responded Revenue range
6 Who responded # Facilities
7 Who responded Vehicles
8 Who responded Employee #
9 Greatest insurable risk concern Data breach 57% Fire 28% Natural catastrophe (storm, flood) 14% Transportation related losses 14% General liability 10% Perceived coverage gaps More than half were satisfied with coverage Items mentioned by those not satisfied: General Liability Rack collapsing Data breach Bonding/employee crime insurance Property of others issues Excess Valuation Business revenue replacement for annuity businesses Lack of agent industry familiarity in some markets Claims: 72% had no claims We had a breach and are still in litigation. The insurance company did not offer the insurance we needed and told them we needed before the breach but denies that fact Customers who were not insured did not understand that and put pressure on us to pay for the recovery of records. Insurers tried to limit the insured value by dividing it by a number of boxes rather than accepting a total insured value. Data Breach Coverage 54.8% of respondents have no data breach coverage 45.2% identified coverage as follows: Employee fidelity bonds Errors and Omissions insurance Public liability insurance (GL) Network security liability and Professional liability Business management and indemnity Storage off premises, fidelity bonding, transit property coverage and legal defense Roundtable discussions What is the most confusing thing you are dealing with regarding insurance policies and coverage? What is the insurable risk that keeps you awake at night? What efforts are you making to mitigate risks through operations, contracts or other noninsurance areas? Best practices discussion Property Coverage Comm Gen Liability Auto Worker s Compensation Warehouseman s Legal E&O and Privacy Other
10 Types of insurance carried
11 Ins. Policy costs as % of gross revenue Property CGL Auto Comp < > 3 Uncat.
12 Questions? Jim Booth cell: Bryan Paulozzi cell:
13 Getting to Know E & O Jim Booth, Brightstone Insurance Services and Brightstone Consulting Services At one time, information management liability risk was fairly limited. Those days are long gone. The greatest liability risk now facing information management companies is a data breach. According to a 2011 Ponemon Institute Report, the cost of a data breach climbed to $214 per compromised record (Ponemon Institute, LLC, 2012). Each incident averaged $7.2 million. A small business may not survive an incident of this magnitude and must protect itself in some other way. That is the purpose of a well-written errors and omissions (E & O) insurance policy. E & O insurance is also known as professional liability insurance. It is a specialized insurance product designed to protect an operator from specific liabilities associated with the services they perform. Most persons are familiar with medical malpractice insurance, which is a form of professional liability insurance. E & O is not meant to replace the other casualty insurance policies an operator may have, such as general liability or auto liability, but rather protect against a different set of exposures, for example, protecting you from the hazards of a data breach. Selecting the Right Product To make an intelligent decision regarding E & O insurance, it is necessary to engage in a bit of education. The fundamental questions in insurance do not change a decision must be made based on what you want to insure, the hazards you are insuring against, and the flexibility of coverage application in a claim scenario. In the case of E & O, the fundamental concern is the preservation and protection of your business. Regardless of the services performed, a substantial claim could exceed your capability to satisfy the claim. If that happens, your business is in great jeopardy. Commercial information management companies seek additional insurance protection like E & O to mitigate losses due to data breach incidents. A significant breach can multiply losses across a range of categories. Cost of legal defense is a component of most policies, and provides payment of legal defense costs to defend your business against claims. Policy holders are generally offered a choice between a duty to defend (an insurer s obligation to provide defense against claims made under a liability policy) or reimbursement of defense costs. Depending upon the policy selected, other types of coverage associated with E & O may include the payment of fines or penalties, reimbursement for notification costs and credit monitoring, and business interruption and extra expense costs associated with restoring network operations. Coverage is not limited to just these areas. Additional hazards might include funds transfer fraud, e-commerce extortion attempts, computer program and data-restoration expenses, crisis management event expenses, computer fraud, and communications and media liability. Exclusions are an important consideration when selecting the appropriate policy. E & O is liability coverage; some exclusions may be in place because there are (or should be) other liability policies that already cover losses of that nature. For example, if one of your delivery vehicles is backing out of a dock area and destroys an ornamental pillar on the client s property, E & O would not cover this type of loss, even though it occurred as you were providing services. Why? This is already covered in a commercial auto liability policy. The same would be true for a client who slips and falls when reviewing records in your viewing room. The general liability policy is in place to cover losses of this nature. Policies should always be reviewed carefully, especially when exclusions are concerned. In some cases, a carrier may exclude a vital coverage, such as fines for regulatory violations, and reinsert the coverage later in the policy under endorsements. Here is an example of an exclusion from an actual policy specimen: any action brought by or on behalf of the Federal Trade Commission (FTC), Federal Communications Commission (FCC), or any other federal, state, or local government agency or other licensing organizations in such entity s regulatory, quasiregulatory or official capacity, function, or duty. Because some data breach actions may be pursued by the FTC, an interpretation of that language in isolation would lead a policy holder to believe that breaches involving the FTC would be excluded from coverage. However, in the endorsements section of the same policy specimen, language appears along with the instruction that the previous language is deleted and replaced as follows: any action brought by or on behalf of the FTC, FCC, or any other federal, state, or local government agency or other licensing organizations in such entity s regulatory, quasiregulatory, or official capacity, function, or duty other than is expressly covered hereunder as a result of a breach of privacy regulations. 12 PRISM International
14 One additional consideration when selecting E & O coverage is the issue of claims. All policies dealing with liability are designed to pay someone else in the event of a loss. Some events may require a rapid response to control costs and maintain client goodwill. In response to this need, there are some E & O carriers that provide first-party coverage. This type of coverage pays you in the event of a loss, so that you can act in coordination with the client and insurance carrier to respond to a situation that could quickly spiral out of control. A data breach incident is a prime example. With no involvement in the investigation or notification process, the client may perceive a lack of concern or responsibility on your part. Firstparty coverage provides a means to engage immediately during the initial stages of a breach event and keep everything under control, especially cost and client relationships! How can you know for sure whether you have coverage in a certain situation? You must read the policy carefully! Before coverage is bound you should ask to be provided a copy of the policy. Taking the time to read the policy completely is absolutely essential. Insuring agreements are contracts. You would not sign a contract without reading it, and you should not bind insurance coverage without reading the policy and making a determination that the risks you intended to cover in the policy are actually included in the policy document. As much as you may like and trust your insurance broker, you must never rely on his or her opinion. Insurance is a personal contract between you and the carrier and you must make sure your interests are adequately protected by conducting your own careful review. Careful reviews of this type require enough time to assess, study, consult, and revise. It is helpful to budget at least 90 days into the renewal or quotation process to make sure you have adequate time to carry out these important activities. As to the question of how much insurance is the right amount, the data from Ponemon and other sources help define the extent of a possible loss. When considering those costs, the selection of a limit can be made based on the individual organization s appetite for risk. By having an in-depth conversation with your insurance broker and others who are central to the protection of your business s welfare, such as your attorney and accountant, you can make a more informed insurance decision regarding limits. Operational Mitigation of Risk Some service activities lend themselves to claims that would be made under an E & O policy. Any activity involving the transportation, transfer, or storage of sensitive information is a key area for information management professionals. The use of subcontractors is another. In conducting a self-assessment focused on mitigating risk, it is instructive to use questions asked by insurers as a guide. Their actuarial methods have identified areas likely to generate claims and, by inference, operational steps that could be taken to prevent or reduce risks inherent in providing professional services. Here are seven key areas of focus to help mitigate internal risk and improve business operations. Encryption Perhaps no technology holds greater promise for mitigating the effects of a data breach than encryption. Where the Health Insurance Portability and Accountability Act (HIPAA) is concerned, a breach event is not deemed to have occurred if data have been encrypted to applicable National Institute of Standards Technology standards. In the information management industry, it is most common to think of encryption 7 Keys to Mitigate Internal Risk Encryption Contract Language Policies IT System Review Employee Training Disaster Recovery Planning and Testing Loss History as it relates to data tapes. The insurance perspective is much broader. Common questions regarding encryption involve not only removable media but also server encryption, encryption of data transmission, encryption of data on work stations (especially laptops), wireless network encryption, and encryption of data on portable devices. Clients should also be encrypting materials before they send them off site. Technologies such as self-encrypting drives have greatly reduced the cost of implementation. Encryption should be addressed whenever you are selling data protection services or structuring contracts. Contract Language PRISM International members have long been familiar with terms found in the Standard Storage and Service Agreement, particularly language dealing with the limitation of liability. There has been some concern expressed by legal professionals as to whether the combined use of a contract and work order constitute a complete warehouse s receipt and whether the lack of a warehouse s receipt invalidates other provisions of the Uniform Commercial Code (UCC). This is a matter to take up with your attorney if it remains a concern for you. Insurance carriers who write E & O policies are very interested in several aspects of client contracts, such as whether indemnification language in your contract favors you or the client. Review contract language to make sure your services and payment terms are well-defined (which in most cases would be a function of the Schedule A and may involve defining some terms to remove any type of ambiguity). There are also risks associated with subcontractors, specifically whether you have contracts in place with subcontractors and whether subcontractors are required to indemnify you. Policies Effective policies are a key area of focus for underwriters. Privacy policies are especially critical, including whether such policies were drafted by an attorney, whether they appear on your website, and how often they are reviewed. Policies regarding the handling of third-party information, records retention and disposition, and the disposal of equipment that may contain sensitive data are central to the information management industry. Policies and procedures dealing with employee termination are a point of focus, especially when immediate removal of access to networks and facilities is concerned. If coverage is to be bound in areas like cyberliability, there will also be many questions related to website content, content ownership, copyright and trademark issues, and policies regarding framing and linking of content. A number of policies and procedures are driven by compliance efforts within 14 PRISM International
15 the organization. As a result, underwriters may inquire about whether policies have been reviewed against applicable laws, rules, and regulations and are compliant. IT System Review Vulnerabilities within IT systems account for the majority of data breaches around the world. Verizon s 2012 Data Breach Investigations Report (Verizon RISK Team, 2012) confirmed that 98% of data breaches originated outside the organization, with fewer than 1% originating with business partners. In the same report, it was reported that 81% of breaches were a result of some form of hacking, and 96% of hacks were judged as being not highly difficult. The report also found that 94% of all data compromised involved servers, and 85% of breaches took weeks or more to discover. It is no wonder that insurance carriers remain intensely interested in IT systems. Firewall technology, antivirus software, intrusion detection software, password policies, and internal and external verifications of system integrity through audit are ways to mitigate potential risk. Policies and procedures requiring software updates as soon as they are available helps reduce risk because updates may correct previous vulnerabilities or protect software against new threats. In addition, other external and regulatory audits often appear on applications particularly related to Payment Card Industry Data Security Standard (PCI DSS) audit and certification, HIPAArelated audit and certification, and Gramm Leach Bliley (GLB) audit and certification. The Verizon report underscores the importance of these external audits. The report states that 96% of victims subject to PCI DSS had not achieved compliance. Employee Training Training employees in areas like safe information handling procedures, compliance-related requirements inherent in HIPAA, and IT policies and procedures is one of the best strategies for preventing losses and claims. This includes maintaining confidentiality agreements with employees and enforcing compliance. Some insurers also request that the person within the organization responsible for computer security is identified by name and title. If no such person exists within your organization, a strategy to develop such a role should be a priority. Disaster Recovery Planning and Testing Because E & O coverage can include areas like crisis management, data restoration, and business interruption, having a fully formed disaster recovery plan, business continuity plan, and incident management plan become focus points. This will cover some very familiar territory, like off-site data protection services and hot-site contracting for emergency off-site restoration of operations. There will also be divergence in the purpose of some of these plans: a data breach is not necessarily a disaster but will certainly be an incident that requires an effective response strategy. In recent years, some clients have included a request that elements of, or, in some cases, complete disaster recovery/business continuity/incident response plans be included as a part of the bid submission. Taking the time to create these documents may provide a sales advantage over competitors who have not engaged in this type of exercise. Of course, a plan is only helpful if it works. All plans should be tested on a periodic basis, improved whenever possible, and updated frequently. Tests may include other employee safety or emergency equipment testing as well. Loss History This may seem obvious, but a failure to respond appropriately to a prior loss can leave a business vulnerable to both the vagaries of the marketplace and the negative responses of underwriters who may not have an appetite for extending coverage to organizations that do not appear to have learned from their mistakes. If you have experienced an incident that was (or would have been) covered by E & O insurance, it is important to identify the points of risk and vulnerability and work to minimize those risks. These questions will be asked on any E & O application. That should be reason enough to perform an assessment and adjust operations, policies, and procedures. Probably a more important and long-lasting reason to engage in this type of response strategy is to become a better business. These efforts can become the seed for overall quality improvements and may boost employee morale at a time when it will probably be stretched thin. So what would occur in the case of a loss? The most important thing to remember in an insurance context is to contact your insurance agent immediately! After claim forms are completed, the matter is assigned to an attorney, and the insurance company takes over from there. In the case of thirdparty coverage, which is more typical of standard policies, the insurance company reacts to the client s claims when they are made. This could take some time because costs may not be known for a while. In the case of first-party coverage, the insurance company acts immediately on your behalf to assist with notification, credit monitoring, and other critical steps that must be taken to comply with breach notification laws. A Vital Tool E & O insurance is a vitally important risk mitigation tool that helps protect your business in an environment of increasing risk. This type of insurance is fundamentally different than other types of liability insurance and is critically important to organizations that have exposure through the transfer and storage of third-party information. Although E & O is vital, it should not represent the only strategy to mitigate risk. Implementation of strong encryption technology across the enterprise, IT vulnerability audits, policy development, employee training, strong contract terms, and reassessment of lessons learned from previous losses are all strategies that can be employed to protect your business. F References Ponemon Institute LLC. (2012 March) cost of data breach study: United States. Retrieved October 16, 2012, from www. symantec.com/content/en/us/about/media/pdfs/b-ponemon cost-of-data-breach-us.en-us.pdf?om_ext_cid=biz_socmed_twitter_facebook_marketwire_linkedin_2012Mar_worldwide CODB_US. Verizon RISK Team. (2012) data breach investigations report. Retrieved October 16, 2012, from About the Author Jim Booth is the records and information management practice group leader for Brightstone Insurance and is a principal with Brightstone Consulting Services. He can be reached by at jbooth@brightstoneins.com. 16 PRISM International
NATIONAL RECOVERY AGENCY COMPLIANCE INFORMATION GRAMM-LEACH-BLILEY SAFEGUARD RULE
NATIONAL RECOVERY AGENCY COMPLIANCE INFORMATION GRAMM-LEACH-BLILEY SAFEGUARD RULE As many of you know, Gramm-Leach-Bliley requires "financial institutions" to establish and implement a Safeguard Rule Compliance
Cyber Liability Insurance. Data Security, Privacy and Multimedia Protection
Cyber Liability Insurance Data Security, Privacy and Multimedia Protection Cyber Liability Insurance Data Security, Privacy and Multimedia Protection What is a Cyber Risk? Technology is advancing at such
Cyber Enhancement Endorsement
Cyber Enhancement Endorsement What is Cyber Risk? Why should I buy Cyber Risk insurance? What is the cost? Why should I buy Great American s product? Who do I contact to learn more about Cyber Risk Insurance?
Protecting Against the High Cost of Cyberfraud
Protecting Against the High Cost of Cyberfraud THE ROLE OF CYBER LIABILITY INSURANCE IN YOUR RISK MANAGEMENT STRATEGY Paying the Price...2 The Ransomware Scourge...3 Policy Provisions...3 Management Liability...4
ACORD 834 (2014/12) - Cyber and Privacy Coverage Section
ACORD 834 (2014/12) - Cyber and Privacy Coverage Section ACORD 834, Cyber and Privacy Coverage Section, is used to apply for cyber and privacy coverage. The form was designed to be used in conjunction
H 7789 S T A T E O F R H O D E I S L A N D
======== LC001 ======== 01 -- H S T A T E O F R H O D E I S L A N D IN GENERAL ASSEMBLY JANUARY SESSION, A.D. 01 A N A C T RELATING TO INSURANCE - INSURANCE DATA SECURITY ACT Introduced By: Representatives
Data Security Addendum for inclusion in the Contract between George Mason University (the University ) and the Selected Firm/Vendor
Data Security Addendum for inclusion in the Contract between George Mason University (the University ) and the Selected Firm/Vendor This Addendum is applicable only in those situations where the Selected
Claims Made Basis. Underwritten by Underwriters at Lloyd s, London
APPLICATION for: NetGuard Plus Claims Made Basis. Underwritten by Underwriters at Lloyd s, London tice: The Policy for which this Application is made applies only to Claims made against any of the Insureds
Cyber Risk Insurance. Frequently Asked Questions
Cyber Risk Insurance Frequently Asked Questions Frequently Asked Questions What is Cyber Risk? Why should I buy Cyber Risk Insurance? What is the cost? Who is Great American Insurance? Why should I buy
Cyber Risk Proposal Form
Cyber Risk Proposal Form Company or trading name Address Postcode Country Telephone Email Website Date business established Number of employees Do you have a Chief Privacy Officer (or Chief Information
Privacy and Data Breach Protection Modular application form
Instructions The Hiscox Technology, Privacy and Cyber Portfolio Policy may be purchased on an a-la-carte basis. Some organizations may require coverage for their technology errors and omissions, while
When The Wind Blows: Renewable Energy Risk Management Strategies
When The Wind Blows: Renewable Energy Risk Management Strategies Small Wind Conference 2017 1 Overview About HUB Insurance Solutions General Coverage Overview Stakeholders Cyber Liability Engineers and
Cyber, Data Risk and Media Insurance Application form
Instructions The Hiscox Technology, Privacy and Cyber Portfolio Policy may be purchased on an a-la-carte basis. Some organizations may require coverage for their technology errors and omissions, while
AXIS PRO PRIVASURE INSURA
AXIS Insurance Telephone: (678) 746-9000 111 S. Wacker Dr., Ste. 3500 Toll-Free: (866) 259-5435 Chicago, IL 60606 Facsimile: (678) 746-9315 Website: www.axiscapital.com/en-us/insurance/us#professional-lines
APPLICATION for: TechGuard Liability Insurance Claims Made Basis. Underwritten by Underwriters at Lloyd s, London
APPLICATION for: TechGuard Liability Insurance Claims Made Basis. Underwritten by Underwriters at Lloyd s, London SECTION I. GENERAL INFORMATION 1. Name of Applicant: Physical Address: (as it should appear
Does the Applicant provide data processing, storage or hosting services to third parties? Yes No
BEAZLEY BREACH RESPONSE APPLICATION NOTICE: THIS POLICY S LIABILITY INSURING AGREEMENTS PROVIDE COVERAGE ON A CLAIMS MADE AND REPORTED BASIS AND APPLY ONLY TO CLAIMS FIRST MADE AGAINST THE INSURED DURING
HIPAA BUSINESS ASSOCIATE AGREEMENT BUSINESS ASSOCIATES AND SUBCONTRACTORS
HIPAA BUSINESS ASSOCIATE AGREEMENT BUSINESS ASSOCIATES AND SUBCONTRACTORS This HIPAA Business Associate Agreement ( BAA ) is entered into on this day of, 20 ( Effective Date ), by and between Allscripts
ChicagoLand RIMS Cyber Insurance Coverage Pitfalls and How to Avoid Them
ChicagoLand RIMS Cyber Insurance Coverage Pitfalls and How to Avoid Them PROVIDED BY HUB INTERNATIONAL October 25th, 2016 W W W. C H I C A G O L A N D R I S K F O R U M. O R G AGENDA 1. The evolution of
HIPAA AND ONLINE BACKUP WHAT YOU NEED TO KNOW ABOUT
WHAT YOU NEED TO KNOW ABOUT HIPAA AND ONLINE BACKUP Learn more about how KeepItSafe can help to reduce costs, save time, and provide compliance for online backup, disaster recovery-as-a-service, mobile
Cyber-Insurance: Fraud, Waste or Abuse?
SESSION ID: STR-F03 Cyber-Insurance: Fraud, Waste or Abuse? David Nathans Director of Security SOCSoter, Inc. @Zourick Cyber Insurance overview One Size Does Not Fit All 2 Our Research Reviewed many major
CYBER AND INFORMATION SECURITY COVERAGE APPLICATION
NOTICE: THIS APPLICATION IS FOR CLAIMS-MADE AND REPORTED COVERAGE, WHICH APPLIES ONLY TO CLAIMS FIRST MADE AND REPORTED IN WRITING DURING THE POLICY PERIOD, OR ANY EXTENDED REPORTING PERIOD. THE LIMIT
Data Breach Program Pricing Companies with revenues less than $1,000,000
Data Breach Program Pricing Companies with revenues less than Limit of Liability Aggregate $250,000 $500,000 $2,000,000 Retention $1,000 $1,000 $1,000 $1,000 25,000 records $250,000 $500,000 Security &
CYBER LIABILITY INSURANCE OVERVIEW FOR. Prepared by: Evan Taylor NFP
CYBER LIABILITY INSURANCE OVERVIEW FOR Prepared by: Evan Taylor NFP Targeted Industries Business Sector Financial Services 10% Non-Profit 11% Retail 10% Other 37% Other 18% Type of Data PII 40% Professional
A Step By Step Guide To Dealership Compliance Team One research and Training /Summit Group
A Step By Step Guide To Dealership Compliance 2008 Team One research and Training /Summit Group As you probably already know, 2008 has brought the automobile dealer a whole new set of compliance issues
CYBER LIABILITY REINSURANCE SOLUTIONS
CYBER LIABILITY REINSURANCE SOLUTIONS CYBER STRONG. CYBER STRONG. State-of-the-Art Protection for Growing Cyber Risks Businesses of all sizes and in every industry are experiencing an increase in cyber
Cyber Risks & Insurance
Cyber Risks & Insurance Bob Klobe Asst. Vice President & Cyber Security Subject Matter Expert Chubb Specialty Insurance Legal Disclaimer The views, information and content expressed herein are those of
HIPAA Privacy & Security. Transportation Providers 2017
HIPAA Privacy & Security Transportation Providers 2017 HIPAA Privacy & Security As a non emergency medical transportation provider, you deal directly with Medicare and Medicaid Members healthcare information
Cyber ERM Proposal Form
Cyber ERM Proposal Form This document allows Chubb to gather the needed information to assess the risks related to the information systems of the prospective insured. Please note that completing this proposal
DEBUNKING MYTHS FOR CYBER INSURANCE
SESSION ID: GRC-F02 DEBUNKING MYTHS FOR CYBER INSURANCE Robert Jones Global Head of Financial Lines Specialty Claims AIG Garin Pace Cyber Product Leader AIG @Garin_Pace Introduction What Is Cyber Insurance?
Data Processing Appendix
Company Name* Execution Date *Company name indicated must conform to the name on customer s Master Subscription Agreement executed with SugarCRM. This Data Processing Appendix on the processing of personal
Advisory Standards I. GOVERNMENT REGULATIONS & GOVERNING DOCUMENTS
Advisory Standards I. GOVERNMENT REGULATIONS & GOVERNING DOCUMENTS The AGRiP Advisory Standards covering Government Regulations and Governing Documents address the legal requirements placed on pool formation
DELHAIZE AMERICA PHARMACIES AND WELFARE BENEFIT PLAN HIPAA SECURITY POLICY (9/1/2016 VERSION)
DELHAIZE AMERICA PHARMACIES AND WELFARE BENEFIT PLAN HIPAA SECURITY POLICY (9/1/2016 VERSION) Delhaize America, LLC Pharmacies and Welfare Benefit Plan 2013 Health Information Security and Procedures (As
Business Associate Agreement
This Business Associate Agreement Is Related To and a Part of the Following Underlying Agreement: Effective Date of Underlying Agreement: Vendor: Business Associate Agreement This Business Associate Agreement
March 1. HIPAA Privacy Policy
March 1 HIPAA Privacy Policy 2016 1 PRIVACY POLICY STATEMENT Purpose: The following privacy policy is adopted by the Florida College System Risk Management Consortium (FCSRMC) Health Program and its member
AXIS PRO TechNet Solutions Renewal Application
AXIS Insurance Telephone: (678) 746-9000 111 S. Wacker Dr., Ste. 3500 Toll-Free: (866) 259-5435 Chicago, IL 60606 Facsimile: (678) 746-9315 Website: www.axiscapital.com/en-us/insurance/us#professional-lines
Healthcare Data Breaches: Handle with Care.
Healthcare Data Breaches: Handle with Care November 13, 2012 ID Experts Webinar www.idexpertscorp.com The material presented in this presentation is not intended to provide legal or other expert advice
Cyber & Privacy Liability and Technology E&0
Cyber & Privacy Liability and Technology E&0 Risks and Coverage Geoff Kinsella Partner http://map.norsecorp.com http://www.youtube.com/watch?v=f7pyhn9ic9i Presentation Overview 1. The Cyber Evolution 2.
BREACH MITIGATION EXPENSE COVERAGE
POLICY NUMBER: QBPC-2030 (09-16) THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. BREACH MITIGATION EXPENSE COVERAGE This endorsement modifies insurance provided under the following: INSURANCE
REF STANDARD PROVISIONS
This Data Protection Addendum ( Addendum ) is an add- on to the Purchasing Terms and Conditions. It is applicable only in those situations where the Selected Firm/Vendor provides goods or services under
Evaluating Your Company s Data Protection & Recovery Plan
Evaluating Your Company s Data Protection & Recovery Plan CBIA Cybersecurity Webinar Series 11AM 12PM Part V. Presented by: Stewart Tosh Charles Bellingrath Date: December 7, 2017 Today s presenters Stewart
LICENSE AGREEMENT. Security Software Solutions
LICENSE AGREEMENT Security Software Solutions VERIS ACTIVE ID SERVICES AGREEMENT between Timothy J. Rollins DBA Security Software Solutions, having an office at 5215 Sabino Canyon Road and 4340 N Camino
Cyber Risk Management
Cyber Risk Management Privacy & Data Protection Agenda 2 Introductions Risk Management 101 Defining & Quantifying a Breach Prevention, Mitigation & Transfer Strategies Finance Strategy- Cyber Insurance
DATA COMPROMISE COVERAGE RESPONSE EXPENSES AND DEFENSE AND LIABILITY
THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. DATA COMPROMISE COVERAGE RESPONSE EXPENSES AND DEFENSE AND LIABILITY Coverage under this endorsement is subject to the following: PART 1 RESPONSE
South Carolina General Assembly 122nd Session,
South Carolina General Assembly 122nd Session, 2017-2018 R184, H4655 STATUS INFORMATION General Bill Sponsors: Reps. Sandifer and Spires Document Path: l:\council\bills\nbd\11202cz18.docx Companion/Similar
APPLICATION FOR DATA BREACH AND PRIVACY LIABILITY, DATA BREACH LOSS TO INSURED AND ELECTRONIC MEDIA LIABILITY INSURANCE
Deerfield Insurance Company Evanston Insurance Company Essex Insurance Company Markel American Insurance Company Markel Insurance Company Associated International Insurance Company DataBreach SM APPLICATION
STEPPING INTO THE A GUIDE TO CYBER AND DATA INSURANCE BREACH
STEPPING INTO THE A GUIDE TO CYBER AND DATA INSURANCE BREACH 2 THE CYBER AND DATA RISK TO YOUR BUSINESS This digital guide will help you find out more about the potential cyber and data risks to your business,
THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY CRISIS MANAGEMENT COVERAGE The Insurer shall pay on behalf of the Insured: 1) Crisis Management Expenses that are a direct result of a Network
Directors & Officers Insurance 101
Directors & Officers Insurance 101 The outlines of coverage used throughout this presentation are not intended to express any legal opinion as to the nature of coverage. They are only intended to provide
STRUCTURAL ENGINEERS ASSOCIATION OF ARIZONA. Gail S. Kelley, P.E., Esq., LEED AP June 3, 2017
STRUCTURAL ENGINEERS ASSOCIATION OF ARIZONA Gail S. Kelley, P.E., Esq., LEED AP June 3, 2017 2 Engineer shall indemnify, defend, and hold harmless the Client Suggested changes: Delete the word defend Edit
Consumer Federation of America Best Practices for Identity Theft Services. March 10, 2011
Consumer Federation of America Best Practices for Identity Theft Services March 10, 2011 Consumer Federation of America Best Practices for Identity Theft Services Table of Contents Introduction 3 About
Allocating Risk for Privacy and Data Security in Commercial Contracts and Related Insurance Implications
Allocating Risk for Privacy and Data Security in Commercial Contracts and Related Insurance Implications Presented by: Selena J. Linde George Galt Aaron Coombs June 23, 2016 Perkins Coie LLP Presenter:
DATA COMPROMISE COVERAGE FORM
DATA COMPROMISE DATA COMPROMISE COVERAGE FORM Various provisions in this policy restrict coverage. Read the entire policy carefully to determine rights, duties and what is and is not covered. Throughout
HIPAA COMPLIANCE ROADMAP AND CHECKLIST FOR BUSINESS ASSOCIATES
HIPAA COMPLIANCE ROADMAP AND CHECKLIST FOR BUSINESS ASSOCIATES The Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment
ZURICH LAWYERS PROFESSIONAL LIABILITY INSURANCE APPLICATION
ZURICH LAWYERS PROFESSIONAL LIABILITY INSURANCE APPLICATION THIS APPLICATION IS FOR A CLAIMS-MADE AND REPORTED POLICY. IF ISSUED, PLEASE READ YOUR POLICY CAREFULLY. Please type or print clearly in ink.
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This Agreement, dated as of, 2018 ("Agreement"), by and between, on its own behalf and on behalf of all entities controlling, under common control with or controlled
Building a Program to Manage the Vendor Management Lifecycle
Building a Program to Manage the Vendor Management Lifecycle Libbie Canter Amelia Hukoveh Daniel Nazar October 5, 2017 Overview 1. Introduction and Background 2. Three Pillars of Third-Party Risk Management
CYBER LIABILITY: TRENDS AND DEVELOPMENTS: WHERE WE ARE AND WHERE WE ARE GOING
CYBER LIABILITY: TRENDS AND DEVELOPMENTS: WHERE WE ARE AND WHERE WE ARE GOING 2015 Verizon Data Breach Report 79,790 security incidents 2,122 confirmed data breaches Top industries affected: Public, Information,
Insuring! Agreement Claim! Scenario Coverage! Response Network &! Information! Security Liability A hacker successfully obtains sensitive, personal information from the insured s computer system. As a
REMOTE DEPOSIT MERCHANT CHECK CAPTURE SERVICES AGREEMENT
REMOTE DEPOSIT MERCHANT CHECK CAPTURE SERVICES AGREEMENT This Merchant Check Capture Agreement ( Agreement ) is between MIDWEST BANKCENTRE ( MBC ) and (each being called a Company ). MBC and Company agree
UNITED OF OMAHA Contracting Checklist
UNITED OF OMAHA Contracting Checklist Agent/Agency: Direct Upline: Agent #: Documents To Be Completed & Returned: Contract Information and Signature Form Fair Credit Reporting Act Disclosure Individual
Cyber Risk Mitigation
Cyber Risk Mitigation Eide Bailly Howalt + McDowell Insurance Introduction Meet your presenters Eric Pulse Risk Advisory Director 20 years in the public accounting and consulting industry providing information
The Wild West Meets the Future: Key Tips for Maximizing Your Cyber and Privacy Insurance Coverage
The Wild West Meets the Future: Key Tips for Maximizing Your Cyber and Privacy Insurance Coverage James P. Bobotek james.bobotek@pillsburylaw.com (202) 663-8930 Pillsbury Winthrop Shaw Pittman LLP DOCUMENT
MEDIATECH INSURANCE APPLICATION THIS APPLICATION IS FOR A CLAIMS MADE POLICY PLEASE INDICATE WHICH COVERAGES ARE REQUIRED Technology and Professional
THIS APPLICATION IS FOR A CLAIMS MADE POLICY PLEASE INDICATE WHICH COVERAGES ARE REQUIRED Technology and Professional Services: $100,000 $250,000 $500,000 $1,000,000 $2,000,000 Other:$ Technology Product
DATA HANDLING AGREEMENT
DATA HANDLING AGREEMENT This agreement is for the provision of the transfer of school data between the School, Wonde and approved third party applications. Wonde Ltd a company registered in England under
PRIVACY AND CYBER SECURITY
PRIVACY AND CYBER SECURITY Presented by: Joe Marra, Senior Account Executive/Producer Stoya Corcoran, Assistant Vice President Presented to: CIFFA Members September 20, 2017 1 Disclaimer The information
Negotiating Business Associate Agreements
Negotiating Business Associate Agreements February 19, 2015 William J. Roberts, Esq. Shipman & Goodwin LLP 2015. All rights reserved. HARTFORD STAMFORD GREENWICH WASHINGTON, DC About HIPAA HIPAA is a federal
Cybersecurity Threats: What Retirement Plan Sponsors and Fiduciaries Need to Know and Do
ARTICLE Cybersecurity Threats: What Retirement Plan Sponsors and Fiduciaries Need to Know and Do By Gene Griggs and Saad Gul This article analyzes cybersecurity issues for retirement plans. Introduction
RESTRICTIONS ON USE OF INFORMATION AND CONTENT
Bicksdrive.com Terms of Use Agreement Bicksdrive.com (the Website ) is owned and operated by Bick s Driving School of Eastern Cincinnati ( Bick s, we, or us ). Bick s values your interest in its goods
University Data Policies
BACKGROUND Data are valuable institutional assets of Washington State University. Data policies are needed to ensure that these resources are carefully managed, maintained, protected, and used appropriately.
RIMS Cyber Presentation
RIMS Cyber Presentation Forrest Pace Cyber & Strategic Risk Leader South Zone AIG Property Casualty Forrest.Pace@aig.com 1 Bio Forrest Pace is the Cyber and Strategic Risk Leader for the South Zone, coordinating
HIPAA Information. Who does HIPAA apply to? What are Sync.com s responsibilities? What is a Business Associate?
HIPAA Information Who does HIPAA apply to? HIPAA applies to all Covered Entities (entities that collect, access, use and/or disclose Protected Health Data (PHI) and are subject to HIPAA regulations). What
DATA PROTECTION ADDENDUM
DATA PROTECTION ADDENDUM In the event an agreement ( Underlying Agreement ) entered into by and between (i) either Sunovion Pharmaceuticals Inc. or its subsidiary, Sunovion Pharmaceuticals Europe Ltd.
Insurance Requirement Provisions in Technology Contracts: Mitigating Risk, Maximizing Coverage
Presenting a live 90-minute webinar with interactive Q&A Insurance Requirement Provisions in Technology Contracts: Mitigating Risk, Maximizing Coverage THURSDAY, OCTOBER 5, 2017 1pm Eastern 12pm Central
PAI Secure Program Guide
PAI Secure Program Guide A complete guide to understanding the Payment Card Industry Data Security Requirements (PCI DSS) and utilizing the PAI Secure Program Welcome to PAI Secure, a unique 4-step PCI-DSS
BUSINESS ASSOCIATE AGREEMENT (for use when there is no written agreement with the business associate)
BUSINESS ASSOCIATE AGREEMENT (for use when there is no written agreement with the business associate) This HIPAA Business Associate Agreement ( Agreement ) is entered into this day of, 20, by and between
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This Agreement ( Agreement ) is entered into by and between Applications Software Technology Corporation (AST) ( Business Associate ) and Pinellas County, for and on
Determining Whether You Are a Business Associate
The HIPAApotamus in the Room: When Lawyers and Law Firms are Subject to HIPAA Enforcement, And How to Comply with the Law by Leslie R. Isaacman, J.D., M.B.A. The Omnibus Final Rule 1 of the Health Information
HIPAA Compliance Guide
This document provides an overview of the Health Insurance Portability and Accountability Act (HIPAA) compliance requirements. It covers the relevant legislation, required procedures, and ways that your
HIPAA Background and History
Agenda Jeffery P. Drummond Lawyers as HIPAA Business Associates: Ethical Obligations and Practical Tips for Compliance Dallas Bar Association January 17, 2018 Jamie Sorley An Overview of HIPAA The Privacy
ACC Nonprofit Organizations Committee
ACC Nonprofit Organizations Committee Nonprofit Insurance in the USA Overview and Tips May 9, 2017 2017 Willis Towers Watson. All rights reserved. Disclaimer Willis Towers Watson and its affiliates do
TERMS AND CONDITIONS OF SERVICE 1. DEFINITIONS: Affiliate means any entity which directly or indirectly owns or controls, is controlled by, or is
TERMS AND CONDITIONS OF SERVICE 1. DEFINITIONS: Affiliate means any entity which directly or indirectly owns or controls, is controlled by, or is under common control with, Donnelley Financial or Client,
Largest Risk for Public Pension Plans (Other Than Funding) Cybersecurity
Largest Risk for Public Pension Plans (Other Than Funding) Cybersecurity 2017 Public Safety Employees Pension & Benefits Conference Ronald A. King (517) 318-3015 rking@ I am convinced that there are only
"HIPAA RULES AND COMPLIANCE"
PRESENTER'S GUIDE "HIPAA RULES AND COMPLIANCE" Training for HIPAA REGULATIONS Quality Safety and Health Products, for Today...and Tomorrow OUTLINE OF MAJOR PROGRAM POINTS OUTLINE OF MAJOR PROGRAM POINTS
NOTICE OF CHANGE IN TERMS
NOTICE OF CHANGE IN TERMS Effective August 1, 2015 ( Amendment Effective Date ), the 2002 version of the Comerica Treasury Management Services Master Agreement ( 2002 Master Agreement ) and the version
Understanding Cyber Risk in the Dental Office. Melissa Moore Sanchez, CIC
Understanding Cyber Risk in the Dental Office Melissa Moore Sanchez, CIC Data Breaches are Escalating Between February 5, 2005 and May 26, 2012 561,465,563 records containing sensitive personal information
Summary of Form Changes e-md /MEDEFENSE Plus Insurance Policy (from version P1818CE-0115 to P1818CE-0716)
GENERAL CHANGES 1. Notice Provisions Summary of Form Changes e-md /MEDEFENSE Plus Insurance Policy (from version P1818CE-0115 to P1818CE-0716) a. Currently, the policy requires notice to the Underwriters
OLD DOMINION UNIVERSITY PCI SECURITY AWARENESS TRAINING OFFICE OF FINANCE
OLD DOMINION UNIVERSITY PCI SECURITY AWARENESS TRAINING OFFICE OF FINANCE August 2017 WHO NEEDS PCI TRAINING? THE FOLLOWING TRAINING MODULE SHOULD BE COMPLETED BY ALL UNIVERSITY STAFF THAT: - PROCESS PAYMENTS
PO Terms for Ariba (Effective as of ).DOC
TERMS AND CONDITIONS 1. GENERAL. The vendor/seller (the Company ) identified on the attached purchase order (the PO ) shall provide the purchaser identified on the PO ( Purchaser ) all products and/or
Regenstrief Center for Healthcare Engineering HIPAA Compliance Policy
Regenstrief Center for Healthcare Engineering HIPAA Compliance Policy Revised December 6, 2017 Table of Contents Statement of Policy 3 Reason for Policy 3 HIPAA Liaison 3 Individuals and Entities Affected
A FRAMEWORK FOR MANAGING CYBER RISK APRIL 2015
APRIL 2015 CYBER RISK IS HERE TO STAY Even an unlimited budget for information security will not eliminate your cyber risk. Tom Reagan Marsh Cyber Practice Leader 2 SIMPLIFIED CYBER RISK MANAGEMENT FRAMEWORK
2017 Cyber Security and Data Privacy Study
RESEARCH REPORT DECEMBER 2017 2017 Cyber Security and Data Privacy Study How does your company compare? TABLE OF CONTENTS 05 How does your company compare? 06 Key findings 08 Cyber security and data privacy
Overview and Consent. Additional Terms and Relationship to Other Agreements
Overview and Consent I understand that this Agreement between me and Fidelity (Fidelity refers to Fidelity Brokerage Services LLC, Fidelity Distributors Corporation and National Financial Services LLC,
ARE YOU HIP WITH HIPAA?
ARE YOU HIP WITH HIPAA? Scott C. Thompson 214.651.5075 scott.thompson@haynesboone.com February 11, 2016 HIPAA SECURITY WHY SHOULD I CARE? Health plan fined $1.2 million for HIPAA breach. Health plan fined
Reviewing and Drafting IT Agreements
Reviewing and Drafting IT Agreements March 10, 2015 Peter J. Kinsella 303/291-2328 The information provided in this presentation does not necessarily reflect the opinions of Perkins Coie LLP, its clients
DATA SERVICES CONTRACTS
GUIDANCE DOCUMENT DATA SERVICES CONTRACTS MAY 2003 Guidance Document: Data Services Contracts 1 CONTENTS 1.0 Purpose of this Guidance Document... 1 2.0 General... 2 2.1 Definitions... 2 2.2 Privacy Impact
SERVICE AGREEMENT. In consideration of the mutual covenants set forth herein, the parties agree as follows:
SERVICE AGREEMENT This Service Agreement ( Agreement ) is entered into by and between The Regents of the University of California on behalf of the University of California, San Diego, a public, not-for-profit,
Cybersecurity Privacy and Network Security and Risk Mitigation
Ask the Experts at fi360 2016 Cybersecurity Privacy and Network Security and Risk Mitigation Gary Sutherland, NAPLIA CEO Brian Edelman, Financial Computer Inc. CEO Paul Smith, AIF NAPLIA SVP SEC s 1st
FORM 14 BROKER-DEALER FIDELITY BOND New York
FORM 14 BROKER-DEALER FIDELITY BOND New York Most broker-dealer firms rely on our Fidelity Bond Program to protect their assets. Here s why: Our Fidelity Bond Program is designed specifically for broker-dealer
Record Management & Retention Policy
POLICY TYPE: Corporate Divisional EFFECTIVE DATE: INITIAL APPROVAL DATE: NEXT REVIEW DATE: POLICY NUMBER: May 15, 2010 May - 2010 March 2015 REVISION APPROVAL DATE: 5/10, 3/11, 5/12, 9/13, 4/14, 11/14
CONTRACT GUIDANCE FOR TROUT UNLIMITED CHAPTERS AND COUNCILS.
CONTRACT GUIDANCE FOR TROUT UNLIMITED CHAPTERS AND COUNCILS. Table of Contents. Table of Contents. 1 I. Introduction. 2 II. Required Reviews and Getting Help. 2 III. Existing TU Policies. 3 IV. TU's Liability