A Lesson in Timely Claims Reporting

A recent appeals decision denied coverage to a company on its directors and officers (D&O) liability insurance policies for taking too long to file the claim. 

In this case, the 5th U.S. Circuit Court of Appeals in New Orleans sided with an insurer that had denied a claim a company had made after being sued for failing to pay overtime wages to nonexempt employees.

The insurance company had denied the claim because the first employees’ claim was made in August 2014, but the company failed to inform the insurer of that and subsequent claims until September 2015.

This case illustrates the importance of filing claims in a timely manner.

When the employer actually got around to filing the claim it had an in-force D&O policy with the insurer, although there was an earlier policy in force when it had received the first claim of failing to pay overtime.

Under the policy in force at the time of the first claim, the insurer would have been obligated to pay all claims made against the company under the policy.

“That earlier policy would have provided coverage except that the insured failed to comply in 2014 with a notice provision. We conclude the district court was correct to rely on this difference,” the three-judge panel in the appellate court wrote in an opinion that upheld a lower court’s ruling.

Timeliness

One of the critical obligations of an insured is the duty to timely report claims or circumstances that may give rise to a claim. Failure to report a claim in accordance with the policy requirements can result in a claim being denied, or worse, having the entire policy voided.

D&O policies are “claims made” policies, meaning that coverage exists only for claims made during the time period the policy is in effect. Claims made while no policy or extended reporting period are in effect are not covered.

Claims-made policies also have retroactive dates. Ideally, the retroactive date is the day the insured started business, but it can also be the day that it first purchased professional liability coverage.

Assuming the retroactive date has not been advanced, the policy in force when a claim is made is the policy that will respond, regardless of when the negligent act, error or omission took place.

However, there is one important qualifier. This insurance applies to claims that took place after the retroactive date, but prior to the end of the policy period, provided that the insured had no knowledge of the claims prior to the effective date shown in the declarations.

In other words, if you knew of a claim prior to the time you renewed your claims-made policy but did not report it, and if a claim is subsequently made, the insurance company can deny coverage. It doesn’t matter whether or not it’s been continuously renewed by one insurance company, the policy excludes it.

This underscores the importance of timely reporting of all claims prior to renewal each year.

The Risks of Staff Using Personal Devices for Work

As more employees use their personal mobile devices for work companies are being forced to confront the resulting security implications as well as how the devices are changing behaviors in the workplace.

That’s according to a report by Littler Mendelson, an international law firm specializing in employment and labor law. The report highlights the dangers and benefits of allowing employees to use their personal devices at work.

As more people buy smart phones and tablet computers and bring them to work to use to perform company tasks, businesses have responded by implementing policies that allow employees to use their personal mobile devices to create, store, and transmit work-related data.

This trend is generally referred to as "Bring Your Own Device" or BYOD. Some companies even allow employees to replace their work laptop computer with their own personal PC, which is sometimes referred to as BYOC.

The report highlights two broad categories of risks personal devices in the workplace pose: data risks and behavioral risks.

Data Risks

The report looked at five information security threats posed by BYODs:

Lost or stolen devices – According to study by the Ponemon Institute, 39% of respondents reported that their organizations had sustained a data security breach in 2011 as a result of lost or stolen equipment. Put simply, if your employees use their personal mobile devices for work, your company data is at risk if they lose their gadget.

Malware – In February 2012, Juniper Networks reported a 155% increase from 2010 to 2011 in the volume of malicious software created for mobile devices, and malware targeting the Android platform rose 3,325%.

Friends and family – A report by the U.S. Treasury Department's Financial Crimes Enforcement Network found that in 27.5% of suspicious activity reports filed by depository institutions between 2003 and 2009, the identity theft victim knew the suspected thief, who was usually a family member, friend, acquaintance, or an employee working in the victim's home.

Links to the cloud – A number of apps for mobile devices allow users to store their documents and data using cloud-based storage, the report states. Employers must evaluate whether the sites provide sufficient security if the employee plans to store company information using the apps.

Security breach – If you have a breach in security, it could expose your company to government enforcement actions, civil penalties and litigation. There are both federal and state-level statutes and regulations on the books that govern storage of personal information in addition to contractual obligations, which increasingly are including responsibilities to safeguard against data breaches and the consequences for failing to do so.

Behavior issues

There is another downside that has not been much discussed. In the 2011 National Business Ethics Survey, the Ethics Resource Center reported that active social networkers (employees who spend 30% or more of their work day participating on various social network sites) are more likely to believe that certain questionable behaviors are acceptable, such as:

• “Friending” a client or customer.

• Blogging or tweeting negatively about your company or colleagues.

• Keeping a copy of confidential work documents in case they need them in their next jobs.

• Taking a copy of work software home for use on their personal computers.

In addition:

• Wage and hour implications can arise from using a mobile device to conduct work while off the clock.

• Both state and federal laws require employers to reimburse employees for expenses that arise in the course of doing their jobs. Once employees are using their own devices it raises questions of whether the employer is required to reimburse for the cost of the device, the data plan and monthly phone bill.

Littler Mendelson includes in its report a slew of recommendations for employers. When drawing up policies on BYODs, the employer should:

• Decide which employees should be permitted to participate in a BYOD program. You may want to exclude senior executives whose data is more likely to be relevant in litigation, research and development employees and sales staff, who may store client information on their devices.

• Create policies that address off-the-clock work.

• Staff should know that if they BYODs the company must be authorized to access their devices for record retention or litigation holds or investigations.

• Before allowing employees to use dual-use devices to perform work, companies should obtain their written consent to monitor the device, remotely wipe the device, install security software and copy data if necessary.

• Follow good security practices.

• Create policy barring friends or family from using the device.

• Create a policy limiting the use of cloud-based storage.

• Address safety issues, including a prohibition using the device while driving.

• Your policy should include consequences for non-compliance.

As Cyber Attacks Rise, Is Your Business Protected?

Cyber attacks on companies’ information systems and data have reached unprecedented proportions, and are growing with each passing year.

The biggest threat to an organization is if there’s been a breach of personally identifiable data or credit card information that it stores. That results in a number of costs, including notification costs, providing those whose data was compromised with credit monitoring, potential fines, legal costs if sued – and even reputational costs. If data is stolen, there are also restoration costs.

The threat is largest for smaller organizations. Because larger companies can afford to hire teams of technicians to thwart attacks, cyber criminals are increasingly targeting small and mid-sized organizations as they may not have the same resources to defend their data. The “2019 Internet Security Threat Report” by Symantec found that:

• 48% of cyber attacks target small business.

• Just 14% of small businesses rate their ability to mitigate cyber risks, vulnerabilities and attacks as highly effective.

• 60% of small companies go out of business within six months of a cyber attack.

Ransomware

According to the Symantec report, in 2018, enterprises accounted for 81% of all ransomware infections. While overall ransomware infections were down, enterprise infections were up by 12% from the 2017 level.

With ransomware, hackers gain access to your IT system, lock it down and demand a ransom to release it. The ransom usually has to be paid in bitcoin or other cryptocurrency so that the criminals can avoid detection.

Phishing and malware

One of the most common ways for criminals to compromise an organization’s data is through phishing, a process through which employees are sent e-mails with links, which if they are clicked, gives the hackers entry into the company’s computer systems. Malware is usually the code that is inserted into the computer system to either slow systems down or to access the information.

What you can do

• Install anti-malware software – This can weed out the latest malware before it does damage.

• Keep your software up to date – Using up-to-date versions of operating systems, applications, firmware and browser plug-ins helps protect against the latest threats by patching security vulnerabilities.

• Use strong passwords – Use a password manager tool to generate unique passwords and securely store your log-ins.

• Lock down your devices – If your staff uses company-owned devices, or you allow them to use their own, require that the devices are locked with a password, fingerprint or other method.

• Think twice before downloading – Remind staff to be cautious about downloading new software or browser plug-ins.

• Click carefully – Teach your staff to look for telltale signs of phishing e-mails that prompt them to click on malicious links.

The ultimate protection

Cyber-liability insurance covers losses that result from data breaches and other cyber events.

While cyber-liability policies vary among insurers, there are some common threads:

Loss or damage to data – Many policies cover the costs to restore or recover lost, stolen or corrupted data, and may also cover the cost of outside experts or consultants you hire to preserve or reconstruct your data.

Loss of income or extra expenses – Many policies cover income you lose and extra expenses you incur to avoid or minimize a shutdown of your business after your computer system fails due a covered peril. The perils covered may be the same as those covered under damage to electronic data.

Cyber-extortion losses – Cyber-extortion coverage applies when a hacker or a cyber thief breaks into your computer system and demands a ransom to unlock it, or to not damage the data. Extortion coverage typically applies to expenses you incur (with the insurer’s consent) to respond to an extortion demand, as well as the money you pay the extortionist.

Notification costs – Policies may cover the cost of notifying parties affected by the data breach by government statutes or regulations. They may also include the cost of hiring an attorney to assess your firm’s obligations under applicable laws and regulations.

Network security liability – This covers lawsuits that individuals or companies file against your organization alleging negligence on your part for failing to adequately protect data belonging to customers, clients, employees or other parties.