Category: Insurance Coverage

Transferring Cybersecurity Risk: Considerations When Obtaining Cyber Insurance

While procuring cyber insurance is an increasingly important business decision, choosing cyber insurance is not a simple process of merely identifying the amount of coverage desired and then paying for the corresponding premium.  Instead, as set forth below, it presents a matrix of considerations to be explored to ensure receipt of appropriate coverage when needed.

The Importance of Cyber Insurance

In the face of continued and more destructive cyber threats and the advent of more demanding statutory and regulatory requirements, it is critical for a company not only to mitigate risk through comprehensive cybersecurity management but also to transfer that risk by obtaining tailored cyber insurance.  Indeed, more rigorous regulations, along with their attendant financial penalties for noncompliance (such as the EU’s General Data Protection Regulation (“GDPR”), which became effective May 25, 2018, or the NY Department of Financial Services (“NYDFS”) cybersecurity regulation, which was instituted in 2017) are likely to become the norm, not the exception.  Violation of these more recent rules and requirements (and potential expenses and related fines) also do not apply only when data is lost through an actual breach, but also when data is destroyed or cannot be accessed (ransomware) and when data is improperly collected.  Moreover, cyber risks and costs are indiscriminate and affect all industries.

To offset these serious risks, cyber insurance usually is necessary.  Third-party cyber liability claims are not covered under most general liability policies including the Insurance Service Organization’s industry standard GL form.  Director & Officer liability policies usually exclude cyber liability claims.  Property policies, including the ISO “All Risk” form, typically exclude first party cyber claims.  Limited first party cyber coverage may be available through crime policies, and some Information Technology Industry Errors & Omissions policies afford third party cyber coverage.  In most cases, however, only a cyber policy can assure a company of the desired coverage.  A company has a much better chance for coverage and a prompt resolution of its claim under a cyber policy without the need to resort to litigation.

While cyber insurance has been available since the late 1990’s, it is rapidly expanding because of the continued need for a holistic approach to cybersecurity protection.  Indeed, insurance companies expect a surge of business as companies rush to purchase cyber insurance following the arrival of tougher regulations like the GDPR.

Cyber security and liability risks also often involve highly-technical, rapidly evolving information technology issues.  A prospective insured should inquire regarding the cyber experience of its broker, particularly if it is not using a large multi-line producer who has access to an IT consultant or cyber specialist.  Some brokers specialize in cyber insurance, and an insured should consider using a broker who possesses cyber experience.  While “bare bones” cyber coverage is available from authorized or “admitted” insurers, more comprehensive niche cyber coverage often is available only in the surplus lines or “non-admitted” market and can be brokered only by surplus lines producers.

The selection of an insurer is even more important.  In addition to issues of Best’s Financial Quality and Size Ratings, many insurers offer low cost, bares bones thirdparty coverage, while other insurers offer broader, albeit more expensive, coverage, and better claim service.

Cost-wise, premiums will be lower for those companies with comprehensive cyber-risk management plans in place with demonstrated levels of security and internal controls, i.e., better security equals lower risk, which equals more competitive pricing.  A company therefore is further incentivized to ensure it has adequate procedures in place to prevent, detect, investigate, and report data breaches.

The Level of Coverage Needed: Initial Considerations

One of the most important steps in the process of obtaining cyber insurance is to determine what type of coverage a company needs based on reasonably anticipated cyber risks inherent to a company’s business and position in the marketplace.  There are multiple considerations a company should undertake in assessing the kind and amount of coverage needed.

What type of company are you?

A company should consider:

>> its industry and the type of services it offers;

>> the type of data it handles (e.g., financial information, health information, credit information);

>> the makeup of its customers (e.g., whether they include EU citizens); and

>> what regulations it must follow.

Depending upon the kind of data it collects and handles, the company will be subject to a different array of regulations, which should inform the company regarding the type of cyber insurance coverage to be sought.  If a company is a financial institution, it must comply with the privacy rules of the Gramm Leach Bliley Act.  If the company handles personal health information, it will be subject to the privacy requirements of the Health Insurance Portability and Accountability Act, HIPAA.  If the company handles the data of EU citizens, it will be subject to the privacy restrictions (and severe potential penalties) of the GDPR.

First-Party and Third-Party Costs

The company also should think about the kinds of costs it may incur to manage a cyber incident/breach and whether cyber insurance coverage to defer or recoup all of those costs is necessary or prudent.  Such first-party costs can include:

>> forensic investigation costs to determine the source of the cyber incident/ breach and the extent of harm caused

>> remediation costs to rectify any network problem or software deficiencies

>> notification costs to customers whose data was compromised

>> data restoration costs of data stolen, lost, or altered

>> business interruption costs to help restore business functions and to maintain business capabilities while responding to a cyber incident

>> legal costs to evaluate regulatory obligations and assess any liability

>> public relation costs to help maintain and/or restore confidence in the company

Considering these first-party costs, however, is not as straightforward as it may seem.  For instance, assuming a company wants a policy to cover notification costs to advise its customers of a data breach, a company still needs to determine the type of notification it envisions.  Does it merely want to comply with statutory notification requirements or might it want to take a more aggressive approach to notification for customer relation purposes?  And how is the company going to notify its customers?  Email?  Regular mail?  First Class mail?  Similarly, when assessing remediation costs, the company also needs to determine if it wants to provide credit monitoring to its customers and have those costs covered under a cyber policy.  A company must think through these issues to help ensure the right cyber insurance coverage is obtained.

Furthermore, a company may also incur third-party costs as a result of a cyber-event, such as defending against a litigation or regulatory action.  Contemplating cyber coverage for these types of third-party costs also compels additional considerations regarding the extent of coverage desired.  For example, legal fees in defending a claim often can approach or even exceed the ultimate cost of settling the claim.  A company should decide if it wants its litigation costs to erode the policy’s limit of liability, sometimes referred to as being “cost-inclusive,” or whether defense costs should be in addition to the limit of liability.  With regard to a regulatory inquiry, while payment of fines and penalties is unlawful in some jurisdictions and is often excluded from coverage, the company must determine if it wants coverage to include investigatory costs in responding to the governmental inquiry.  Some policies cover up to half of the investigatory costs of responding to a governmental inquiry or subpoena, usually subject to a sublimit on liability.

Do the Provisions of the Policy Ensure the Desired Coverage?

Once a company identifies the coverage it hopes to purchase, it then is essential to carefully consider the specific provisions of a cyber policy to ensure receipt of the level of coverage sought for the cyber risk possibilities reasonably envisioned.  Among the questions when analyzing the policy’s provisions are:

>> When is coverage triggered?

>— Is the policy written on an “occurrence” basis, i.e., the breach must occur during the policy period to be covered, or is it written on a claimsmade basis, i.e., the claim must be made and reported during the policy period in order for coverage to be available?

>— If the policy is written on a claims-made basis, does the breach nevertheless have to occur during the policy period, does it merely have to be discovered in the policy period, or both?

— Is intentional conduct required (by a third-party or malicious company insider) or can coverage be triggered by the negligence of an employee?

>— Is the conduct of a malicious insider to the company covered or must the cyber incident be caused by an outside third-party?

>— Must data have been disseminated outside the company (a breach) or will the policy also cover situations where data is destroyed or cannot be accessed (e.g., ransomware)?

>> What kind of information is covered?

>— How is “personal information” defined?

>— Is “confidential corporate information” covered?

>> Does the policy require minimum security requirements be maintained to protect the company’s computer network and data?

>> What devices are covered?

>— Are only the company’s servers and computers covered?

>— How are mobile devices (laptops, mobile phone, thumb drives) treated?

>— If the company allows employees to use personal devices or work remotely (BYOD – Bring Your Own Device policies), are cyber incidents originating on an employee’s personal device covered?

>> Are cyber breaches or incidents caused by vendors assisting the company (e.g., HVAC, data processors, cloud providers) covered?

>— Would coverage only extend to breaches caused by a vendor on the company’s network?

>— Would coverage extend to a breach of a vendor’s network housing the company’s data?

>> What are the policy provisions regarding notice and defense of a claim?

>— How quickly does the policy require a claim to be reported to the carrier?

>— Whose knowledge of a breach is imputed to the company for the purpose of determining whether a claim has been reported late and whether an exclusion applies?

>— Does the definition of “claim” include responding to a subpoena?

— Is the defense obligation of the policy a “duty to defend” where the insurer controls the defense and settlement of a claim or does the policy have a duty to advance defense costs, which permits the policyholder to control the defense and settlement of the claim at the cost of the insurer?

>— If the policy has a duty to advance costs, are there limitations on who the company can retain as outside counsel or as a forensic expert?

>— Are regulatory investigations covered?

>— Does the policy cover investigatory costs in responding to a governmental inquiry?

>— Are fines covered?  If so, is the company domiciled in a jurisdiction where indemnification against fines and penalties is not against public policy?

>— How is regulator defined?  Does it cover EU regulators?

To be sure, disputes between policyholders and insurance carriers are inevitable, and insurers will attempt to strictly construe policies against coverage.  Courts are just beginning to interpret cyber insurance policy provisions, sometimes coming out on opposite sides of the same issue depending upon the jurisdiction.

For instance, courts have disagreed whether cyber insurance policies cover losses resulting from social engineering, i.e., when a company employee is falsely manipulated to wire out company funds based on what is believed to be a legitimate email authorizing the transfer but what is actually an email initiated by a fraudster.  Insurers may assert that a loss caused by social engineering (also known as business email compromise) is not a direct loss under the computer fraud provisions of a cyber insurance policy.  Carriers attempt to distinguish between fraudulently causing a transfer (via social engineering) and causing a fraudulent transfer (via hacking into a company’s computer network to wire out funds).

Insurers also have sought to disclaim coverage by invoking exclusions for a company’s failure to maintain agreed-upon levels of cybersecurity to protect the company’s network and data.  Courts have been asked to construe cyber policy provisions to determine whether the insured satisfied the policy’s security requirements.  Considering that industry cybersecurity measures are constantly updated, a company should attempt to avoid a situation where a court’s interpretation of policy language and evaluation of a company’s cybersecurity efforts will determine whether it can recoup losses from a cyber event.

Conclusion

As criminals find new and more inventive ways to attack computer systems or fraudulently cause the theft of company funds, a company faces the increased risk of loss, which can result from a combination of illegal activity, imperfect network security, and employee negligence.  As such, a company should undertake a complete strategy to combat cybersecurity-related threats, which includes procuring appropriate insurance coverage to manage reasonably anticipated cyber risks.  Carriers may attempt to dispute claims, so a company must give special attention to cyber policy language to avoid the possibility of coverage being denied.  To help negotiate policy provisions to avoid ambiguities and potential grounds for disputes, a company should explore using an insurance professional to help negotiate a policy with the desired coverage, including identifying additional policy endorsements that may be available to cover certain specific cyber threats.  When procuring cyber insurance, considering the questions and issues outlined above may make the difference between receiving expected cyber coverage and not.

 

© Copyright 2018 Sills Cummis & Gross P.C.
This post was written by Joseph B. Shumofsky and Thomas S. Novak from Sills Cummis & Gross P.C.

Will Your Company’s Insurance Cover Losses Due to Phishing and Social Engineering Fraud?

Six Tips for Evaluating and Seeking Coverage for Business Email Compromises

If your company fell victim to a business email compromise – a scam that frequently involves hackers fraudulently impersonating a corporate officer, vendor, business partner, or others, getting companies to wire money to the hackers – would your insurance cover your loss?  There is reason to be concerned about this sort of attack, as the FBI has explained that the “scam continues to grow and evolve, targeting small, medium, and large business and personal transactions. Between December 2016 and May 2018, there was a 136% increase in identified global exposed losses” in actual and attempted losses in U.S. dollars.  The good news for policyholders is that courts across the country have been ruling that crime insurance policies should provide coverage for this sort of loss, at least where it is not specifically excluded.

How do business email compromises work?

In early versions of business email compromises, the hackers send emails that appear to be from company executives, discussing corporate acquisitions, or other financial transactions, and are received by company employees in the finance department.  See, e.g., Medidata Sols., Inc. v. Federal Ins. Co., 268 F. Supp. 3d 471 (S.D.N.Y. 2017), aff’d, — F. App’x — (2d Cir. 2018).  The employee is told that the transaction is highly confidential, and that the employee should work closely with an attorney or other financial advisor to help close the deal.  The employee then is told to wire money to cover the costs of the transaction, very often to a foreign country.  Having been defrauded, the employee logs in to an online banking site, and approves a wire transfer.

In other versions of a business email compromise, hackers get access to email accounts of one party, sometimes via a brute force attack where an attacker breaks into a system by guessing a password, or via a phishing attackwhere a user is fooled into typing a username and password into a fraudulent site.  Then, the hacker sends out emails from the compromised account, pretending to be a vendor, and asking for payment to be sent to a different bank account.  See, e.g., Am. Tooling Center, Inc. v. Travelers Cas. & Sur. Co. of Am., — F.3d — (6th Cir. 2018).  Again, having been defrauded, the employee has money wired to the fraudster, instead of to the vendor.

Will insurance cover losses due to business email compromises?

The answer to whether insurance carriers will cover these losses – without court intervention – is “it depends.”  Recent decisions have ordered insurance carriers to provide coverage.  And the insurance industry has been scrambling to write new endorsements for their insurance policies that the insurance companies say provide coverage for business email compromises.

A common place for seeking coverage for these losses is under crime insurance policies.  Many crime insurance policies include coverage for “computer fraud,” “funds transfer fraud,” or even “computer and funds transfer fraud.”  Exemplar “computer fraud” coverage applies to “direct loss” of money resulting from the fraudulent entry, change, or deletion of computer data, or when a computer is used to cause money to be transferred fraudulently.  Exemplar “funds transfer fraud” coverage applies to “direct loss” of money caused by a message that was received initially by the policyholder, which purports to have been sent by an employee, but was sent fraudulently by someone else, that directs a financial institution to transfer money.  A reasonable policyholder, which fell victim to a fraudulent scheme via a computer, or transferred funds because of a fraudulent scheme, likely would think that computer and funds transfer fraud coverages would apply to the losses.

What have courts said?

Two recent decisions from federal courts of appeal have resulted in coverage under crime policies for business email compromise losses.

The first is the July 6, 2018 opinion issued in Medidata Solutions, Inc. v. Federal Insurance Co., No. 17-2492 (2d Cir.).  The Medidata trial court ruled that a crime insurance policy provides coverage for a fraudulent scheme and wire transfer.  The Court of Appeals for the Second Circuit affirmed the trial court’s decision.  In Medidata, the policyholder’s employees received emails that purported and appeared to be from high level company personnel but were, in fact, sent by fraudsters.  Based on those emails, and messages from purported outside counsel, Medidata wired nearly $5 million to the fraudsters.  It sought coverage under a crime policy that it bought from Chubb that had computer fraud, funds transfer fraud, and other coverages.  The trial court ruled that computer fraud and funds transfer fraud coverages both applied.  It rejected the arguments that the loss was not “direct” because there were steps in between the original fraudulent message and the wiring of funds.

On appeal, the Second Circuit ruled that Medidata’s loss was “direct” under the insurance policy language.  “Federal Insurance further argue[d],” as carriers have done in many business email compromise cases, “that Medidata did not sustain a ‘direct loss’ as a result of the spoofing attack, within the meaning of the policy.”  Slip op. at 3.  The Court of Appeals held that because “[t]he spoofed emails directed Medidata employees to transfer funds in accordance with an acquisition, and the employees made the transfer that same day,” the loss wasdirect.  Id.  The court rejected the insurance carrier’s argument that the loss was not direct because “the Medidata employees themselves had to take action to effectuate the transfer”; the employees’ actions were not “sufficient to sever the causal relationship between the spoofing attack and the losses incurred.”  Slip op. at 3.  The Court of Appeals did not address the trial court’s ruling that funds transfer fraud coverage applied, “[h]aving concluded the Medidata’s losses were covered under the computer fraud provision.”  Id.

Shortly after Medidata was issued, the Sixth Circuit decided on July 13, 2018 that computer fraud coverage applies to losses resulting from a business email compromise in American Tooling Center, Inc. v. Travelers Casualty & Surety Co., No. 17-2014 (6th Cir.).  There, the policyholder (ATC) wired money to fraudsters, instead of a vendor, because of a business email compromise.  The Sixth Circuit reversed the district court, ruling that the losses are “direct,” covered by crime insurance.

In a decision that will be published, the Court of Appeals held there was “‘direct loss’ [that] was ‘directly caused’ by the computer fraud,” even though the policyholder had engaged in “multiple internal actions” and “signed into the banking portal and manually entered the fraudulent banking information emailed by the impersonator” after receiving the initial fraudulent emails.  Id.

Holding that coverage applied, the Sixth Circuit distinguished the Eleventh Circuit’s decision regarding computer fraud coverage in Interactive Communications v. Great American, No. 17-11712, ___ F. App’x ___, 2018 WL 2149769 (11th Cir. May 10, 2018).  Id. at 9-10.  After the policyholder in American Tooling had “received the fraudulent email at step one,” it “conducted a series of internal actions, all induced by the fraudulent email, which led to the transfer of the money to the impersonator at step two.”  The loss occurred at step two; as such, “the computer fraud ‘directly caused’ [the policyholder’s] ‘direct loss.’”  Id. at 10.  By contrast, the Sixth Circuit explained, the policyholder in Interactive Communications only suffered losses at step four in a significantly more complicated chain of events.  See id. at 9-10.

These decisions are great news for policyholders pursuing coverage under crime policies for losses resulting from business email compromises.  And, in light of this new authority, policyholders would be well-advised to examine denial letters carefully, giving due consideration to whether these decisions could be used to argue in favor of coverage.

What options are available to policyholders going forward?

Cynical viewers of insurance history might view the state of coverage as similar to what the industry has done in the past.  That is, initially, cover new claims under “old” policies.  Then, after claims get expensive, hire coverage counsel to tell courts why the carriers must not have meant to cover these new claims (whether the drafting history reflects such an intent or not).  Next, get insurance regulators to approve exclusions purportedly tailored explicitly to the risk, and, at the same time, sell new policy endorsements (often for additional premium) that provide lower limits of coverage for the risk.

That’s what is happening in connection with insurance for business email compromises.  At least one insurance group that drafts crime insurance policies has asked for a definition of computer and funds transfer fraud to be changed, and a new social engineering fraud endorsement to be approved for sale.  Insurers have rolled out these endorsements with limits of coverage that often are capped at low amounts, and might also have high retentions.  These endorsements frequently are available for crime policies and, sometimes, are available for cyberinsurance policies as well.

So what are some options for policyholders trying to structure an insurance program for these risks?  These questions should provide helpful tips:

1. What does the insurance policy include? Policyholders would be well-advised to see whether the insurance program includes social engineering fraud endorsements or coverage parts.

2. What are the applicable limits? Policyholders would be well-advised to check the policy limits that would apply to those coverages.  Binder letters might not disclose a sublimit, and the policyholder might not realize the limit of coverage is lower than the full policy limit until it is too late.

3. Are coverages available under more than one policy? At the time of policy renewal, policyholders would be well-advised to consider asking whether social engineering fraud coverage can be added to a crime program and a cyberinsurance program.

4. Will excess coverage apply, and, if so, when? Policyholders would be well-advised to explore whether excess policies will provide this coverage, and, if so, will “drop down” to attach at the level of any sublimit, to avoid donut holes in the coverage.

5. Will other policy provisions provide coverage, beyond narrow endorsements? If the policyholder faces a claim, policyholders would be well-advised to determine whether other coverages might apply to the losses, notwithstanding a social engineering fraud endorsement.

6. What happens if the insurance carrier says, “no,” or that sublimits apply? If the insurance carrier denies coverage, or tries to apply a sublimit, policyholders would be well-advised to be mindful of the interpretation that two Courts of Appeals have used for computer fraud coverage in similar contexts.

 

© 2018 BARNES & THORNBURG LLP
This post was written by Scott N. Godes of Barnes & Thornburg LLP.

Confusion Amongst Texas Courts: When Can Insureds Recover Policy Benefits for Statutory Violations?

While first-party bad faith claims may appear to be a dying notion in other jurisdictions, the tort-based claim in Texas is alive and well. Throughout the years, courts have continued to search for ways to define the common-law standard and balance it with public interest due to the unequal bargaining power in the insured-insurer relationship.1 For this reason, the law of bad faith in Texas is constantly evolving.

Texas imposes a common law duty on insurers to “deal fairly and in good faith with their insureds.”2 A breach of the duty of good faith and fair dealing gives rise to a tort cause of action that is separate from any action for breach of the underlying insurance policy.3 If an insurer breaches its duty of good faith and fair dealing, in addition to interest, court costs and attorney’s fees, the insured can recover actual, i.e. extra-contractual, damages for economic or personal injuries and exemplary damages if: (1) actual damages were awarded for an injury independent of the loss of policy benefits and (2) the insurer’s conduct was fraudulent, malicious, intentional or grossly negligent.4 Exemplary damages are within the jury’s discretion and “must be reasonably proportioned to actual damages.”5

Texas also provides a statutory scheme for bad-faith claims that allows recovery of extra-contractual damages through a private cause of action against an insurer. The statutory bad-faith tort is governed by Chapter 541 of the Texas Insurance Code (“Code”).6 The statutory claim is in addition, and a supplement, to the contractual cause of action against an insurer for breach of an insurance policy. Similar to the common law claim, for Code violations the insured may recover economic damages, but only up to three times the amount of economic damages, i.e. treble damages, for violations committed “knowingly.”7

It is not uncommon in first party bad-faith cases for the insured to assert a breach of contract claim against the insurer for breaching the insurance policy and a tort cause of action against the insurer for violations of the Code. However, extra-contractual tort claims brought pursuant to the Code require the same predicate for recovery as a bad faith claim under a good faith and fair dealing violation.8 Because the frameworks of the statutory and common law claims are so similar, most Texas courts have treated common law claims as redundant.

When considering the damages available under the policy and under the statute, there have been some inconsistencies amongst Texas courts regarding the recovery of policy benefits when there have been statutory violations of the Code. As such, in USAA Texas Lloyds Company v. Gail Menchaca, the Texas Supreme Court seized the opportunity clear up the confusion by addressing the issue of whether an insured can recover policy benefits for Code violations when there has been no breach of the insurance policy.9

USAA v Menchacha

In Menchaca, the Texas Supreme Court acknowledges, “When our decisions create such uncertainties, ‘it is our duty to settle conflicts in order that the confusion will as nearly as possible be set at rest.’”10 Thus, the goal in Menchaca was “to provide clarity regarding the relationship between claims for an insurance policy breach and Insurance Code violations.”11 The primary question was “whether an insured can recover policy benefits as actual damages caused by an insurer’s statutory violation absent a finding that the insured had a contractual right to the benefits under the insurance policy.”12

Following Hurricane Ike in September 2008, Gail Menchaca contacted her homeowner’s insurance company, USAA Texas Lloyds (“USAA”), and reported storm damage to her home.13 The USAA adjuster who inspected Menchaca’s claim found only minimal damage.14 USAA determined that the damage was covered under Menchaca’s policy but declined to pay benefits because the total repair costs did not exceed the deductible under Menchaca’s policy.15 Five months later, at Menchaca’s request, another USAA adjuster re-inspected Menchaca’s home.16 The second adjuster confirmed the first adjuster’s findings and again USAA declined to pay any policy benefits.17 Menchaca filed suit against USAA for breach of the insurance policy and for unfair settlement practices in violation of the Texas Insurance Code. Menchaca sought policy benefits for both claims.18 For the alleged breach of the insurance policy, she sought benefit of the bargain damages, i.e. the amount of her claim for policy benefits and attorney’s fees. For the statutory violations, she sought actual damages, i.e. the loss of the benefits that should have been paid pursuant to the policy, court courts and attorney’s fees.19

The case proceeded to a jury trial and three questions were submitted to the jury.20 Question 1 addressed Menchaca’s breach of contract claim and asked whether USAA failed “to comply with the terms of the insurance policy with respect to the claim for damages filed by Gail Menchaca resulting from Hurricane Ike” and the jury answered “No.” Question 2 addressed Menchaca’s claim for statutory violations and asked “whether USAA engaged in various unfair or deceptive practices, including whether USAA refused to “pay a claim without conducting a reasonable investigation with respect to that claim” and the jury answered “Yes.” Question 3 asked the jury to determine Menchaca’s damages that resulted from either USAA’s failure to comply with the policy or its statutory violations, calculated as “the difference, if any, between the amount USAA should have paid Gail Menchaca for her Hurricane Ike damages and the amount that was actually paid” and the jury answered “$11,350.”21

Both parties moved for judgment in their favor. USAA argued that Menchaca was not entitled to recover for bad faith or extra-contractual liability because the jury found that it did not breach the insurance policy. Menchaca argued that the jury answered Questions 2 and 3 in her favor and neither were dependent on a favorable answer to Question 1. The trial court disregarded Question 1 and entered judgment in Menchaca’s favor. The court of appeals affirmed and the Texas Supreme Court granted USAA’s petition for review.22

In analyzing whether an insured can recover policy benefits as actual damages caused by an insurer’s statutory violation absent a finding that the insured had a contractual right to benefits under the insurance policy, the Court set forth “five distinct but interrelated rules that govern the relationship between contractual and extra-contractual claims in the insurance context.”23 Following the Court’s analysis of these rules, it determined that the court of appeals erred by affirming the trial court’s decision to disregard the jury’s answer to Question 1. The Court further stated, “In light of the parties’ obvious and understandable confusion over our relevant precedent and the effect of that confusion on their arguments in this case, we conclude that a remand is necessary here in the interest of justice.”24 The rules outlined by the Court are as follows:

Rule 1:

General Rule: An insured cannot recover policy benefits for an insurer’s statutory violation if the insured does not have a right to those benefits under the policy.25 This rule is derived from the Court’s rule in that “there can be no claim for bad faith when an insurer has promptly denied a claim that is in fact not covered.”26 Although the fact pattern in Stoker was limited to the bad faith denial of a claim, the Court has since applied the general rule to other types of extra-contractual violations, i.e. failing to properly pay a claim, failing to fairly investigate a claim and failing to effectuate a prompt and fair settlement of the claim.27 The general rule is derived from the fact that Code “only allows an insured to recover actual damages ‘caused by’ the insurer’s statutory violation.”28 In determining whether the insured has to establish a right to benefits and then a breach of the policy to recover policy benefits for statutory violations, the Court stated, “While an insured cannot recover policy benefits for a statutory violation unless the jury finds that the insured had a right to the benefits under the policy, the insured does not also have to establish that the insurer breached the policy by refusing to pay those benefits.”29

Rule 2:

Entitled to Benefits Rule: An insured who establishes a right to receive benefits under an insurance policy can recover policy benefits as “actual damages” under the statute if the insurer’s statutory violation causes the loss of the benefits.30 “If an insurer’s ‘wrongful’ denial of a ‘valid’ claim results from or constitutes a statutory violation, the resulting damages will necessarily include ‘at least the amount of the policy benefits wrongfully withheld.’”31

Rule 3:

Benefits Loss Rule: An insured can recover policy benefits as actual damages under the Insurance Code even if the insured has no right to those benefits under the policy, if the insurer’s conduct caused the insured to lose that contractual right. 32 The Court has recognized this principle in cases alleging claims against an insurer for misrepresenting a policy’s coverage, statutory violations by the insurer which prejudice the insured by waiving its right to deny coverage or is estopped from doing so, and statutory violations that cause the insured to lose a contractual right to benefits that it otherwise would have been entitled to.33 “[A]n insurer that commits a statutory violation that eliminates or reduces its contractual obligations cannot then avail itself of the general rule.”34

Rule 4:

Independent Injury Rule: The first aspect of the rule is that if an insurer’s statutory violation causes an injury independent of the insured’s right to recover policy benefits, the insured may recover damages for that injury even if the policy does not entitle the insured to receive benefits.35 This rule takes into account that there may be some extra-contractual claims that may not “relate to the insurer’s breach of contractual duties to pay covered claims” and recognizes that there may be compensatory damages different from policy benefits that result from the tort of bad faith under common law.36

The second aspect of the independent-injury rule is that an insurer’s violation does not allow the insured to recover any damages beyond policy benefits unless the violation causes an injury that is independent from the loss of the benefits.37 For instance, the Court held in Twin City Fire Ins. Co. v. Davis that “an insured who prevails on a statutory claim cannot recover punitive damages for bad-faith conduct in the absence of independent actual damages arising from that conduct.38 Notably, as it relates to the independent-injury rule, the Court states that an independent-injury claim would be rare, they have yet to encounter one, and “have no occasion to speculate what would constitute a recoverable independent injury.”39

Rule 5:

No-Recovery Rule: An insured cannot recover any damages based on an insurer’s statutory violation unless the insured establishes a right to receive benefits under the policy or an injury independent of a right to benefits.40.

Conclusion

“It is the beginning of wisdom when you recognize that the best you can do is choose which rules you want to live by, and it’s persistent and aggravated imbecility to pretend you can live without any.”41 The Texas Supreme Court has attempted to clear up the confusion caused by its precedent by adopting five rules on the issue of recovery of policy benefits for statutory violations. While the rules appear fairly simplistic and undoubtedly will provide guidance, it remains to be seen whether the opinion actually brings clarity to the situation or simply a lesser degree of confusion for the courts to follow. In any event, the rules in Menchaca appear to weigh in favor of insurers because the law is settled, i.e. there must be a right to receive benefits or a (rare, but possible) independent injury to receive policy benefits for statutory violations.

[1] Universal Life Ins. Co. v. Giles, 950 S.W.2d 48, 53 (Tex. 1997).

[2] Arnold v. Nat’l Cty. Mut. Fire Ins. Co., 725 S.W.2d 165, 167 (Tex. 1987).

[3]Viles v. Sec. Nat’l Ins. Co., 788 S.W.2d 566, 567 (Tex. 1990).

[4] Pena v. State Farm Lloyds, 980 S.W.2d 949, 958 (Tex. App.—Corpus Christi 1998, no pet.); Giles, 950 S.W.2d at 54. See also Arnold, 757 S.W.2d at 168 (stating, “[E]xemplary damages and mental anguish damages are recoverable for a breach of the duty of good faith and fair dealing under the same principles allowing recovery of those damages in other tort actions.”).

[5] Pa Preston Carter Co. v. Tatum, 708 S.W.2d 23, 25 (Tex. App.—Dallas 1985, no writ). There is no set rule or ratio between the amount of actual damages and exemplary damages which will be considered reasonable and the determination is made on a case-by-case basis. Alamo Nat’l Bank v. Kraus, 616 S.W.2d 908, 910 (Tex. 1981).

[6] Texas does not adhere to the Uniform Deceptive Trade Practices Act adopted by many other states, but has its own set of laws, known as the Texas Deceptive Trade Practices Act (“DTPA”). Chapter 541 of the Texas Insurance Code addresses the protection of consumer interests against deceptive, unfair, and prohibited practices within the context of insurance. Chapter 17.50(a)(4) of the DTPA incorporates Chapter 541 of the Texas Insurance Code in its entirety.

[7] TEX. INS. CODE § 541.152

[8] National Sec. Fire & Cas. Co. v. Hurst, 523 S.W.3d 840, 840 (Tex. App.—Houston 14th Dist. 2017, no pet.).

[9] No. 14-0721, 2017 WL 1311752, at *1 (Tex. 2017).

[10] 2017 WL 1311752, at *1.

[11] Id. at *3.

[12[ Id. at *1.

[13] Id. 

[14] Id. 

[15] Id. 

[16] Id. 

[17] Id. 

[18] Id. 

[19] Id. at *3.

[20] Id. at *2.

[21] Id.

[22] Id.

[23] Id. at *4.

[24] Id. at *14

[25] TEX. INS. CODE § 541.151; Stoker, 903 S.W.2d at 341.

[26] Republic Ins. Co. v. Stoker, 903 S.W.2d 338, 341 (Tex. 1995).

[27] Menchaca, 2017 WL 1311752, at *5.

[28] Id. (citing TEX. INS. CODE § 541.151).

[29] Menchaca, 2017 WL 1311752, at *7.

[30] Id

[31] Id. (citing Vail v. Texas Farm Bureau Mut. Ins. Co. v. Castaneda, 988 S.W.2d 189, 188 (Tex. 1998).

[32] Menchaca, 2017 WL 1311752, at *10 (emphasis in original).

[33] Id.

[34] Id.

[35] Id. at *11.

[36] Id.. ; see also Twin City Fire Ins. Co. v. Davis, 904 S.W.2d 663, 666 (Tex. 1995) (identifying mental anguish damages as an example).

[37] Menchaca, 2017 WL 1311752, at *11 (emphasis added).

[38] 904 S.W.2d 663, 666 (Tex. 1995) (citing Federal Express Corp. v. Dutschmann, 846 S.W.2d 282, 284 (Tex. 1993) (stating that “[r]ecovery of punitive damages requires a finding of an independent tort with accompanying actual damages.”). Therefore, insurers are not liable for punitive damages if there is not an independent injury resulting in extra-contractual damages.

[39] Menchaca, 2017 WL 1311752, at *12.

[40].Menchaca, 2017 WL 1311752, at *12; Casteneda, 988 S.W.2d at 198.

[41] WALLACE STEGNER, ALL THE LITTLE LIVE THINGS (PENGUIN BOOKS 1991).

 

© Steptoe & Johnson PLLC. All Rights Reserved.
This post was written by Dawn S. Holiday of Steptoe & Johnson PLLC.

Insurance Coverage in the Post-Weinstein Era

With new headlines involving sexual harassment and other inappropriate sexual conduct continuing to emerge on a daily basis, insurance coverage for claims that might emerge is something every company should consider.

Recently, media reports have discussed settlements of shareholder derivative claims against members of the boards of directors and other senior executives of public companies. These settlements illustrate both the type of corporate liability that can ensue from allegations that a company turned a blind eye to, or otherwise failed to prevent, sexual misconduct allegations, causing financial and reputational harm to the organization, and the critical role insurance can play in protecting companies and their executives against such claims.While reports indicate that one or more of the settlements is being funded entirely from insurance proceeds, it is unclear whether the settlement proceeds will be coming from D&O insurance or EPLI insurance, or both. D&O insurance is intended to cover corporate mismanagement claims but typically contains some form of employment practices liability exclusion. EPL insurance is intended to cover employment practices liability claims but may not cover management liability claims arising from allegations of sexual harassment. This creates a potential gap in coverage that could have serious consequences.

D&O and EPLI policies are not standard and contain different wording and exclusions.

WHAT TO DO?

In this environment, it behooves corporate management of every company to understand the scope of insurance coverage for sexual harassment and management liability claims and to ensure that appropriate coverage is in place without coverage gaps.

Here is what policyholders should do: comprehensively review all relevant corporate insurance programs to determine what coverage is in place for sexual harassment claims of any variety, and for claims arising from corporate actions that might be necessary in the wake of an issue or claim, such as claims of wrongful termination and defamation.

Policies to be reviewed should include CGL, EPL, D&O and E&O.

Determine whether coverage gaps exist and if so, consider enhancing coverage to ensure proper protection.

Understand what needs to happen in terms of notice to insurers in the event of a claim or knowledge of circumstances that might lead to assertion of a claim.

And be aware of the potential for coverage before agreeing to any payments or settlements that might preclude or limit coverage.

© 2017 Proskauer Rose LLP.
This post was written by Seth B Schafler of Proskauer Rose LLP.
Learn more at the Insurance Law Page on the National Law Review.

Effects of Insurance Marketplace Uncertainty

Even as Senators continue to consider “Graham-Cassidy,” the latest Affordable Care Act (ACA) repeal legislation, insurance markets are already reacting to uncertainty and instability brought about by persistent GOP efforts to upend the post-ACA insurance landscape. Between the Trump Administration’s ongoing refusal to commit to long-term funding of the ACA’s cost-sharing reductions (CSRs) and legislative overtures to repeal key portions of the ACA, premiums have increased, insurers have exited state exchanges, and access to health care coverage has been compromised.

As the Congressional Budget Office (CBO) recently estimated, insurers are expected to “raise premiums for marketplace plans in 2018 by an average of roughly 15 percent, largely because of uncertainty about whether the federal government will continue to fund CSR payments and because of an increase in the percentage of the population living in areas with only one insurer.” Speaking to the latter factor, CBO notes that a number of insurers have withdrawn from healthcare exchanges established under the ACA, spurred, at least in part, by “uncertainty about the enforcement of the individual mandate, and uncertainty about the federal government’s future payments for [CSRs].” Although ACA proponents’ (and critics’) most dire predictions were narrowly avoided – that some counties would have no insurers offering marketplace plans – there is little doubt that insurer participation has been adversely impacted by market uncertainty, with pocketbook repercussions for policy-holders.

The turbulent political climate is also likely to reduce the number of insured individuals in 2018. CBO and the Joint Committee on Taxation anticipate lower insurance enrollment as a result of reductions in federal-sponsored advertising and outreach. Department of Health and Human Services officials recently indicated that the advertising budget for the open enrollment period commencing in November would be reduced to $10 million, amounting to a 90% reduction when compared to spending in the last year of the Obama Administration. Grants to “navigators” – nonprofit groups that assist people with marketplace insurance plan enrollment – will be reduced from approximately $63 million to $36 million.

Whether or not the worst is yet to come will hinge on the fate of Graham-Cassidy and the presently-stalled efforts to reach consensus on a bipartisan ACA stabilization bill. In what is turning out to be a recurring theme in 2017, we may have to wait several weeks for the dust to settle and reasoned prognostication to be possible.

This post was written by Matthew J. Goldman & Jordan E. Grushkin of Sheppard Mullin Richter & Hampton LLP., Copyright © 2017
For more legal analysis go to The National Law Review 

Litigation After Devastation: The Legal Storm Surge

Bridges crumbling in Texas. Houses turned to toothpicks in the USVIs. Newly-formed rivers ravaging the streets in South Florida. The devastating destruction from the recent hurricanes that have pummeled the U.S. has uprooted many peoples’ homes and lives, but we have only begun to feel the impact of the surge.

Massive relief efforts have begun, national fundraising, news coverage, responsive legislation, and building codes to name a few. A litigation surge is swelling as well. We have seen several types of cases and class actions churn from a hurricane’s aftermath. Here are some of the types of cases, coverage issues, and expert needs you may see after the storm.

Property Damage and Meteorological Causation

Insurance companies insuring the Southern United States are bracing for the waves of claims that will soon be flooding in. Just as it was following Hurricanes Katrina, Ivan, and Sandy, the hotly-debated issue of whether the damage was caused by wind or water will be the likely focus. While most homeowner insurance policies will cover water damage that was caused by a roof or window that was compromised by wind and allowed water intrusion, most do not cover water that rises from the ground level and enters the home. Experts will be relied upon to determine how water got into a structure, even when it is entirely obliterated.

Insurance companies and attorneys will be looking for experts in meteorology, often with advanced degrees and testifying experience, who can opine on the types of weather conditions that might have existed at a given time in a given place (i.e., Key West when Hurricane Irma struck). The experts could come from academia or environmental institutes and societies. They will be asked to review various data points and speak on weather conditions at a particular time and place to support causation for insurance coverage. Structural engineers will also be needed, preferably with experience in standard insurance practices, procedures, and protocols in evaluating damage caused by hurricanes. They will need to have an understanding of insurance claims handling and will be asked to review various reports and data, some from other engineers, discussing damage caused to structures by the hurricane and opine as to whether or not the reports and data are accurate.

Structural Failures and Faulty Design/Construction

While many large, concrete commercial buildings and bridges are designed to withstand 150+ mph winds and flooding,  they can still be left severely damaged after a storm blows through. Structural failure of buildings, roofs, bridges, and roadways that were expected to withstand hurricane winds will lead to litigation over damage caused by the failure. Structural engineers with expertise in the types of structures at issue, likely licensed engineers, will be needed to examine damage patterns through photos, video, or via a post-storm on-scene inspection. They will also need to use meteorological wind information to determine the cause of the failure and the quality of the design or construction.

Class Actions for Coverage Determinations

Often, the core issues in insurance-related storm damage cases are similar across a wide span of policyholders. These cases will vary depending on the coverage matter at issue, but the most sought-after experts will be familiar with insurance claims standards, protocols, and policy interpretation. Construction experts may also be needed to opine on the necessity and extent of certain repairs required after a storm. Also, standard practices and interactions between contractors and insurance companies during the re-build process will come into question. Class actions may be filed as well, simply as placeholders to toll certain claims-filing deadlines or allow broader bad faith discovery against insurance companies who refuse to pay mass claims.

Litigation Over Price-Gouging

One of the worst scenarios to follow a storm is wide-scale price-gouging and scamming by companies trying to capitalize on the desperation and vulnerability of storm victims. Before the storm, many people preparing for power outages or evacuation will see unfair spikes in essentials such as water and gas. After the storm, shady contractors and tree-removers often flood in, lie about their licensing and credentials, and charge exorbitant fees while performing shoddy, haphazard work, or no work at all. Many states, including Florida, have made it a crime for any service provider to offer or sell essential commodities for an amount that “grossly exceeds the average price” during the thirty days following a declaration of emergency. In the days before Hurricane Irma’s approach, many reported price-gouging for essentials such as water, ice, batteries, and gas when thousands of Floridians were stocking up or evacuating. Class actions alleging price-gouging will likely occur following the storm. Experts in standard industry pricing, manufacture costs, and storm clean-up and repair may be called in to opine on the “average price” of certain essential commodities and post-storm services.

In the wake of Hurricanes Harvey and Irma, we are gearing up for the incumbent waves of litigation and expert requests we anticipate will follow. What types of cases, class actions, and expert needs are you expecting?

This post was written by Annie Dike of IMS ExpertServices, All Rights Reserved. © Copyright 2002-2017
For more legal analysis go to The National Law Review

Hurricanes and Act of God Defenses

Maritime contracts for services generally include clauses for performance, demurrage, deviation, termination, and suspension. Performance may be affected by an Act of God or Force Majeure clause and event. A typical Force Majeure clause reads as follows:

Except for the duty to make payments hereunder when due, and the indemnification provisions under this Agreement, neither Company nor Contractor shall be responsible to the other for any delay, damage or failure caused by or occasioned by a Force Majeure Event as used in this Agreement. “Force Majeure Event” includes: acts of God, action of the elements, warlike action, insurrection, revolution or civil strife, piracy, civil war or hostile action, strikes, differences with workers, acts of public enemies, federal or state laws, rules and regulations of any governmental authorities having jurisdiction in the premises or of any other group, organization or informal association (whether or not formally recognized as a government); inability to procure material, equipment or necessary labor in the open market acute and unusual labor or material or equipment shortages, or any other causes (except financial) beyond the control of either Party. Delays due to the above causes, or any of them, shall not be deemed to be a breach of or failure to perform under this Agreement.

A. Act of God

Act of God or Force Majeure is a defense to many contractual obligations, including performance, deviation, and demurrage. It may also be the basis to suspend or terminate a maritime agreement for cause. It is defined as an abnormal natural event that is overwhelming and cannot be forestalled nor controlled. Skandia Ins. Co., Ltd. V. Star Shipping, AS, 173 F.Supp. 2d 1228 (S.D. Ala. 2001) (Hurricane Georges cargo claim). It is also a defense to certain tort claims like collisions and allisions occurring during a storm. Petition of U.S., Heide Shipping & Trading v. S.S. Joseph Lykes, 425 F.2d 991 (5th Cir. 1970) (vessel break-away in Hurricane Betsy).

When plead, a party must demonstrate that it was prudent in predicting and attempting to avoid the impact of the overwhelming and unexpected natural event and took reasonable precautions under the circumstances. A failure to perform or third party tort damages are not subject to an Act of God defense if the failure results from human agency, neglect or an unseaworthy condition. Compania DeVapores Ins. Co., SA v. Mo-Pac R.R. Co., 232 F.2d 657 (5th Cir. 1985) (cargo claim for failure to take reasonable steps to guard against wind storm).

Following Hurricane Katrina, the U.S. District Court for the Eastern District of Louisiana held that a category 4 or 5 hurricane was an Act of God sufficient to bar a tort claim by a marina owner against the owner of a vessel that broke away from her berth, drifted and hit another vessel. The defense of Act of God applied because, 1) the accident was due exclusively to abnormal natural events without human interest, and (2) there was no intervening negligent behavior by the vessel owner. J.W. Stone Oil Dist., LLC v. Bollinger Shipyard, 2007 WL 2710809 (E.D. La. 2007). Judge Lemmon held in Stone Oil that hurricanes are considered as a matter of law to be an Act of God and defensible unless there is an intervening and contributing act of individual negligence. This obligation includes taking reasonable precautions based upon all available information.

In Simmons v. Lexington Ins. Co., 2010 WL 1254638 (E.D. La. 2010), aff’d., 401 Fed. Appx. 903 (5th Cir. 2010), J),  the courts similarly considered whether reasonable precautions had been taken by a marina to protect a sailboat during Hurricane Katrina under both Louisiana and maritime law. The Court reviewed other Katrina cases, including Conagra Trade Group, Inc. v. AEP Memco, LLC, 2009 WL 2023174 (E.D. La. 2009), and Coex Coffee Int’l., Inc. v. Dupuy Storage & Forwarding, LLC, 2008 WL 1884041 (E.D. La. 2008). (Katrina’s unprecedented flooding and devastation was an Act of God defense.) In Conagra, supra, Judge Fallon was asked to review a contract of affreightment for a cargo of wheat aboard a barge that sunk. Memco was found not negligent in delivering its barge of cargo to an affected berth several days before the weather forecast accurately predicted the landfall of Katrina.

In re S.S. Winged Arrow, 425 F.2d 991 (5th Cir. 1970), affirmed that where a vessel had been sufficiently moored based upon the anticipated path of Hurricane Betsy, the Act of God defense applied to relieve its owner of  tort damages resulting from its breakaway. From a review of the case law involving severe weather events, it is apparent that Act of God defenses will be granted as a defense to both third party tort claims and also contractual claims for failure to perform where reasonable decisions and precautionsunder the circumstances have been made.

B. Performance Clauses

Clauses for demurrage, detention or laytime usually involve delays in the loading or unloading of cargo or the delivery of goods and materials. Laytime is the period of time allowed for loading and unloading. Demurrage and detention are sums paid to compensate for time lost related to the delivery of equipment or cargo. Demurrage begins to run after the passage of laytime or the agreed time of delivery and performance. Damages are awarded for failure to perform. Deviation is an obligation to maintain a proper course in ordinary trade and to timely arrive at the agreed destination. All deviation clauses are subject to certain liberties. Any deviation may affect insurance and hire.

Typically a contract for maritime services can be terminated for cause or for convenience. Similarly, parties may negotiate terms to suspend performance, which would suspend payment of hire and performance of services. A suspension clause is typically an off-hire clause where the contract terms remain but no hire is paid. Usually a vessel owner will be compensated and reimbursed for certain additional expenses if a contract is terminated for convenience. An Act of God clause excuses delays in performance, but in most cases serves to either suspend performance or terminate the contract for cause as between the parties.

Similar defenses are also statutorily allowed under COGSA. Under the COGSA “perils of the sea” defense, a carrier and vessel are not liable for cargo damage proximately caused by an Act of God where the carrier is not independently negligent and its vessel seaworthy when confronted with an unexpected and abnormal event of nature. 46 USC 1304(2) (c) & (d) ; J.Gerber & Co. v S/S SABINE HOWALDT 437 F.2d. 580 (2nd Cir. 1971); Taisho Marine & Fire Ins. Co. v. Sea-Land ENDURANCE 815 F. 2d. (9th Cir. 1270).

C. Conclusion

The purpose of an Act of God clause in a contract or asserted as a defense to a maritime tort is to relieve a defendant from liability for performance and damages where there was an extreme natural event. Whether a particular storm or natural event is considered an ACT OF GOD is a question of fact. The factors to be considered in accessing an ACT OF GOD/FORCE MAJEURE include the intensity of the natural event and whether the conditions would normally be expected. In order to avail oneself of the ACT OF GOD defense a defendant must show a causal connection between the loss and the peril as well as defendant’s freedom from fault.

This post was written by Grady S. Hurley of Jones Walker LLP © 2017

For more legal analysis go to The National Law Review

Contingent Business Interruption Coverage: Insuring the Far-Reaching Effects of Tropical Storm Harvey

Manufacturers and producers are keenly aware of the value provided by business interruption coverage. Typically, this coverage is sold to companies as one of several coverages under their commercial property insurance package. Business interruption coverage is generally triggered by physical damage to a company asset (e.g., a manufacturing plant), which causes a suspension of business activities resulting in a loss of business income.

Tropical Storm Harvey has forced manufacturers and producers across Southeastern Texas to shut down operations while repairing their damaged facilities. These companies will turn to their business interruption carriers to recoup their business income lost during this period. However, for companies doing business in that region, but physically located outside the reach of Harvey, business interruption coverage may not protect them from lost profits caused by the storm.

For example, say a company owns a manufacturing facility in California where it assembles cars. The manufacturer purchases its engines from a company located in the flood-ravaged portions of Texas. If the Texas company is unable to build and deliver engines to California, the manufacturer might be unable to assemble cars for days, possibly weeks. Any business income losses incurred by the California company are unlikely to trigger standard business interruption coverage because the California manufacturing facility did not suffer any physical damage. To fill the gap, manufacturers and producers often purchase contingent business interruption coverage (CBI).

CBI coverage is, in effect, an extension of business interruption coverage to the business activities of suppliers and customers. If an upstream supplier or downstream customer suffers an interruption in business activities, CBI coverage should kick in to reimburse the policyholder for certain lost profits. CBI coverage can be written on specific properties owned by suppliers or customers and/or on a blanket basis.

The value of CBI coverage may vary depending on the precise language of the coverage grant.

Compare Millennium Inorganic Chems. Ltd. v. National Union Fire Ins. Co., 744 F.3d 279, 285-86 (4th Cir. 2014) (CBI coverage was expressly limited to “direct contributing properties” therefore, the presence of an intermediary between policyholder and supplier precluded coverage) to Archer-Daniels-Midland v. Phoneix Assur. Co., 936 F. Supp. 534, 544 (S.D. Ill. 1996) (CBI coverage was not limited to “direct suppliers,” therefore, CBI coverage was appropriate despite an intermediary in the supply chain).

There are a myriad of issues that arise when a company tenders a claim for CBI coverage, all of which need to be carefully considered on a case-by-case basis. For manufacturers and producers that rely on companies in Southeastern Texas, CBI coverage may become vital.

This post was written by Joshua B. Rosenberg of BARNES & THORNBURG LLP© 2017

Trump Administration Takes First Steps to Support Healthcare Exchanges, but Key Questions Remain

healthcare exchangesIn an effort to stabilize the Exchanges and encourage issuer participation, the Centers for Medicare & Medicaid Services (CMS) recently extended the federal Exchange application and rate filing deadlines and published a proposed rule affecting the individual health insurance market and the Exchanges. While issuers will likely see these actions as encouraging signs of the Trump administration’s willingness to support the Exchanges, these actions do not resolve the political uncertainty regarding the Affordable Care Act’s fate or whether cost-sharing reductions will be funded for 2018. These outstanding questions will likely be a key factor in Exchange stability going forward.

In Depth

On February 17, 2017, the Centers for Medicare & Medicaid Services (CMS) published a proposed rule in the Federal Register outlining a series of proposals intended to stabilize the individual health insurance market and the Exchanges created by the Affordable Care Act (ACA). Comments on the proposed rule are due to CMS on March 7, 2017.

On the same day as the proposed rule was published, CMS announced that it was extending the federal Exchange application and rate filing deadlines with the apparent goal of ensuring that the proposed rule changes could be finalized and taken into account when issuers make Exchange participation and rate decisions for 2018. Although issuers are likely to support the proposed rule and delayed federal filing deadlines, it is not clear what effect these changes will have since they do not resolve the ongoing uncertainty regarding the fate of the ACA repeal effort in Congress and federal funding of cost-sharing reductions in 2018.

CMS believes that the proposed “changes are urgently needed to stabilize markets, to incentivize issuers to enter or remain in the market and to ensure premium stability and consumer choice.” The agency’s urgency is underscored by recent reports that Humana would exit the Exchanges entirely for 2018 and other companies have publicly stated that they are uncertain about the extent of their participation in 2018. Looking just at states using healthcare.gov, there are 960 counties with only one issuer in 2017. Additional issuer defections for 2018 would increase the odds that certain counties will have no issuers participating on the Exchange. This would result in residents of such counties being unable to utilize premium or cost-sharing subsidies for which they otherwise qualify.

The proposed rule addresses long-standing issuer concerns about special enrollment periods and perceived gaming of the 90-day grace period available to enrollees receiving premium subsidies. Looking beyond the specific proposals, the proposed rule is significant for the simple fact that it is the Trump administration’s first concrete step to support and stabilize the Exchange market. This likely provides a measure of relief for industry stakeholders that were unsure whether Republicans would be willing to support the Exchanges, which were a key focus of Republican opposition to the ACA. There had been mixed signals during the Trump administration’s first weeks about how it would approach ACA implementation. President Trump issued an executive order his first day in office directing the Secretary of Health and Human Services (HHS) and other agencies to “exercise all authority and discretion available to them to waive, defer, grant exemptions from, or delay the implementation of” ACA requirements, creating uncertainty regarding how this broad directive would be implemented. In addition, the administration reportedly pulled back on advertising healthcare.gov during the final weekend of open enrollment, leading some to speculate that the Trump administration would be less supportive of Exchange stability than the Obama administration. In the proposed rule, however, CMS tries to make clear that it shares issuers’ goals of “improv[ing] the risk pool and promot[ing] stability in the individual market.”

The question remains whether the proposed changes (and the directional signal of Trump administration support) are sufficient to achieve their stated policy goals. That question is significantly influenced by the status of the ongoing legislative process seeking to quickly repeal the ACA. Although CMS has in this proposed rule endorsed the goal of Exchange market stability in anticipation of CY 2018 open enrollment proceeding as planned, a Republican-led Congress and the Trump administration have continued to signal their commitment to repeal the ACA. Even with the recent delay in Exchange product and rate filing deadlines, the political process (and the related uncertainty about the ACA’s fate) may not be resolved by the time issuers need to begin developing their rates and making decisions on CY 2018 participation. The proposed rule also does not resolve lingering questions related to Exchange funding, such as the availability of cost-sharing reductions for 2018, that will likely be a key factor in Exchange stability going forward.

Summary of Proposed Rule Changes

The proposed rule changes are largely designed to close potential avenues of adverse selection and improve the overall risk pool by encouraging healthier individuals to enroll in coverage.

Open Enrollment

CMS proposes shortening the 2018 open enrollment period from November 1, 2017, through January 1, 2018, to November 1 through December 15, 2017. CMS originally proposed that the shortened open enrollment period would be effective for the 2019 open enrollment period, but the agency is now proposing to move this up by one year. CMS expects that this change would improve the risk pool by reducing enrollments late in the open enrollment period spurred by an applicant’s recent discovery of a need to access health care services. This policy would also increase premium payments to plans, as more enrollees would begin the year’s coverage in January instead of February.

CMS likely would need to extensively market the shortened enrollment period to ensure public awareness. It remains to be seen whether the Trump administration is comfortable with such a commitment to marketing the program given the pull back on marketing efforts for the end of CY 2017 open enrollment.

Special Enrollment

CMS proposes a series of limitations on special enrollment periods intended to reduce adverse selection. Previously, issuers had complained that many healthy individuals were forgoing coverage until they were sick, taking advantage of lax special enrollment period rules to enroll in coverage only when it was needed.

To limit gaming, CMS proposes to expand an enrollment verification pilot program for states using healthcare.gov, planned to begin in summer 2017. CMS proposes that applicants enrolling in coverage under a special enrollment period would have their enrollment pended until they provide documentation that they actually qualify for the special enrollment period. Where providing and processing documentation would result in a delay in coverage after the requested coverage effective date, this policy would result in retroactive coverage. As such, where verification results in a delay in coverage of two months or more, CMS proposes to permit enrollees to request a later effective date.

Guaranteed Availability

CMS also proposes to reinterpret the “guaranteed availability” standard, which requires health plans in the individual market to sell coverage to any willing buyer during open or special enrollment periods. CMS proposes to create an exception to guaranteed availability for individuals with unpaid premiums due to the issuer from which the individual is seeking to purchase new coverage. In part, this proposal seems to address issuers’ concern that some individuals have taken advantage of generous grace periods to discontinue premium payment towards the end of a benefit year only to reenroll with the same plan for the next benefit year. Individuals could still enroll in coverage without coming due on unpaid premium amounts by enrolling with a different issuer (if there is more than one issuer participating in the service area).

Accepting Comments on Continuous Coverage Proposals

CMS requests comments on potential policies it could implement to promote continuous coverage, but the agency is not proposing any specific policies at this time. A continuous coverage requirement is a central feature of many Republican ACA replacement proposals as an alternative to the ACA’s individual mandate. The ACA’s statutory guaranteed availability protections are broad, so adoption of a generally applicable continuous coverage requirement would likely require a legislative change. This is, however, a signal that CMS, under HHS Secretary Price and congressional Republicans, is considering similar policy solutions.

De Minimis Variation

CMS proposes to expand the definition of de minimis variation, the amount by which a qualified health plan’s (QHP’s) actuarial value may vary from the statutorily mandated value. CMS proposes to increase the amount of permissible variation to -4/+2 percentage points from the +/-2 percentage points currently permitted. CMS argues that this policy will promote market stability by permitting plans to maintain the same plan design year over year. CMS additionally argues that this policy may promote competition and put downward pressure on premiums, encouraging healthier individuals to participate in the plan.

Network Adequacy

CMS also proposes to defer to states with respect to network adequacy for Exchange plans in federally facilitated Exchange (FFE) and state-based Exchange states. In past years, CMS has proactively verified that QHPs in FFE states have an “adequate” network of providers. Through such reviews, CMS has enforced “maximum time and distance standards” requiring, for at least 90 percent of enrollees, that certain types of providers be within a specified distance and travel time. These quantitative standards mirrored the Medicare Advantage program requirements. CMS proposes to discontinue its analysis of QHP time and distance, instead deferring to state regulators and accrediting bodies.

Network adequacy requirements vary significantly across states, so this change will affect issuers differently. While the National Association of Insurance Commissioners has adopted a new Health Benefit Plan Network Access and Adequacy Model Act, it has not been adopted in any states and defers to individual states to set applicable time and distance standards. Thus, CMS’s deferral of network adequacy to states may permit narrower networks than under CMS’s quantitative standards.

Executive Order on Significant Regulatory Actions

Also of note is CMS’s approach to President Trump’s recent executive order, which requires that any “significant regulatory actions that [impose] costs” be offset through the elimination of costs associated with at least two prior rules. The proposed rule offers an early opportunity to examine how the administration will implement this executive order. CMS determined that the proposed rule “is not a significant regulatory action that imposes cost” under the recent executive order. The basis for this finding appears to be CMS’s belief that the proposed rule results in a net cost reduction. Thus, while CMS characterized the rule as “significant” for creating separate costs and benefits that exceed $100 million, the net cost reduction allows the agency to avoid eliminating two rules. Industry stakeholders should continue to monitor how CMS implements President Trump’s recent executive order.

 Embed from Getty Images

 

ARTICLE BY Ankur J. Goel, Jeremy Earl & Seth Schneer of McDermott Will & Emery

© 2017 McDermott Will & Emery

Important New Law in UK Relating to Payment of Insurance Claims

insuranceAt the moment, English law says that insurers and reinsurers are not under a positive duty to pay valid claims within a reasonable time.  If an insurer/reinsurer delays in paying a claim, or fails to pay at all, an insured/reinsured can only claim the sums due under the policy and interest.  An insured/reinsured cannot claim damages for late payment if it suffers additional losses by reason of a delay.

That position will change after 4 May 2017 when certain parts of the Enterprise Act 2016 introduce a new section 13A into the Insurance Act 2015.

The result of the new legislation is that any insurance/reinsurance (including retrocession) policy issued or renewed after 4 May 2017, and which is subject to English law, will contain an implied term that requires an insurer/reinsurer to pay claims within a reasonable period.  If they act in breach of such a term, then they are potentially liable to pay contractual damages to the insured/reinsured as well as due under the policy and interest.

Going forward there is likely to be debate about what constitutes “reasonable time,” but it will include giving time to an insurers/reinsurer to investigate and assess the claim. And what is “reasonable” will turn on issues such as the type of insurance in question, the size and complexity of the claim, compliance with relevant statutory and regulatory rules/guidance and factors outside an insurer/reinsurer’s control.

The new legislation also provides a defence to an insurers/reinsurer and they will not be in breach of the implied term if they can prove that they have reasonable grounds for not paying the claim. The manner in which the claim is handled will therefore be a factor in determining whether there has been a breach of the implied term.

An insured/reinsured must issue the court claim for damages within one year of the date that the insurer/reinsurer pays all sums due under the insurance contract. This introduces a new limitation period for legal claims under English law.

Insurers and reinsurers should note that it will be possible to contract out of the new provisions provided they do so in a transparent manner and draws this to the insured’s attention before the policy is entered into.

Comment

Whilst on the face of it this is all good news for insureds, insurers can take comfort from the fact that claims for breach of the implied term will not be straightforward and may not therefore be widespread.  In particular, insureds/reinsureds will still have to satisfy the Court on issues such as causation, remoteness and mitigation before a claim can succeed.  And insurers/reinsurers will only be liable for foreseeable losses suffered by their insureds/reinsureds.

Going forward, practical steps to be taken by insurers include responding promptly to an insured’s request for claims’ information, continuing to carefully document the claims process and to consider making interim payments to an insured if appropriate. These will significantly improve the chances of an insurer/reinsurer successfully defending any legal actions taken by insureds/reinsured alleging a failure to pay a claim within a reasonable time and claiming damages.

ARTICLE BY Garon Anthony of Squire Patton Boggs (US) LLP

© Copyright 2017 Squire Patton Boggs (US) LLP