Category: Latest Thinking

By Kayla Cecchine

The Securities and Exchange Commission (SEC) is set to release new rules that will significantly impact the way publicly traded companies manage and disclose cybersecurity incidents to their shareholders.

Cybersecurity incidents have proliferated across the business landscape in recent years and can materially impact business operations, profitability, and overall shareholder value. But until now, there haven’t been strict guidelines around how publicly traded companies must report these incidents to their shareholders. Expected to be announced in April 2023, these new SEC rules are intended to give shareholders immediate visibility into these incidents and how they may affect the company.

Concurrently, we suspect the new regulations will also open up company leadership and board members to additional scrutiny. Not only will leadership need to firm up their incident reporting processes, they’ll also need to protect themselves from lawsuits that may arise in the event of any allegations of inadvertent material misrepresentation during the event disclosure process.

Expected Rule Changes

While not finalized yet, the new SEC rules will likely require all publicly traded companies to take several new steps when it comes to incident reporting. Here are a few new rules we expect the SEC to include in its final draft:

• When to report: Companies will be required to disclose a cyber incident in a Form 8-K four days after learning of the incident and determining its materiality. This four-day window will begin after the company determines the incident to be “material.” It is suspected that the SEC will rely on previously established precedent for the definition of “material,” which public companies are certainly already familiar with.

• What to report: In the initial disclosure, companies will need to report when the event was first discovered, a description of the event, and the effect of the incident on the company’s operations. The business will also need to disclose whether the situation has been rectified or is currently being remediated.

• Duty to update: A company’s responsibility to inform shareholders about the incident does not end with this initial disclosure. Companies will be obligated to provide updates in amended Form 8-Ks if new details emerge or the facts change.

• No expectations for investigations: This duty to inform shareholders applies even if there is an ongoing internal or federal investigation into the matter that could be jeopardized.

How to Prepare and Protect Your Business

With these new rules set to take effect this year, all publicly traded companies will need to consider how they will comply. Here are three ways every public company can prepare:

1. Create a robust cyber response plan: Considering the tight timeframe to file a report, it is critical businesses have a robust cyber response plan in place before a cyber event occurs. Doing so can make all the difference when disaster strikes. Business leaders must make sure they can access these policies if their computer network is down. Communication is also key and company leaders must ensure all legal, tech support, and investor relations teams are informed. Practicing this response plan can help limit the scope of the damage once an attack is detected and speed up the assessment and disclosure processes.

2. Protect leadership with D&O coverage: These new rules will inevitably open companies up to potential lawsuits if shareholders believe the company has made material misrepresentations about the incident and its impact on company performance. Executives will want to reassess and possibly firm up their D&O liability insurance policies to ensure they’re properly protected from these new risks.

3. Keep records in privilege: If a cyber event is detected, company leadership should keep all records on the facts needed for the materiality test in privilege with their attorneys. Not only will organizing these records be useful during any potential investigation down the line, keeping this information privileged will allow companies to better control the narrative.

An Experienced Broker Can Help

At Conner Strong & Buckelew, we’ve been following the SEC cyber disclosure rules closely and fully understand their implications for publicly traded companies. Not only can we help your business prepare, we can assist with setting up cyber response plans as well as reviewing your D&O coverage to ensure your executives are fully protected from potential lawsuits. With the new rules expected to take effect later this year, it is important not to delay. Reach out today to begin reviewing your policies and ensure your company is ready for these new regulations.

hbspt.cta.load(4987031, ‘3f77243b-42f4-4e7b-a563-07c781c172df’, {“useNewLoader”:”true”,”region”:”na1″});

By Daniel Brettler, Michele Fields, Nathalie Smyth, Sarah-Jane Dobson, Mert Guler, and Jeff Owen-Hicks

MENTAL HEALTH CRISIS
Recent statistics from the World Health Organization suggest that the COVID-19 pandemic triggered a 25% increase in the prevalence of anxiety and depression worldwide. This exemplifies a substantial warning that all countries need to vastly improve their mental health services, treatment and support.

More than 320 million people globally suffer from major depressive disorder (MDD), making it one of the leading causes of disability worldwide. With this and other mental illnesses including substance addictions becoming increasingly widespread, the cost has never been higher. In the UK alone, poor mental health is reported to cost the economy over £100bn per year in lost productivity, excluding treatment expenses incurred by healthcare providers and the physical and emotional cost to the sufferers themselves. In recognition of the wider impact of poor mental health, the UK government is publishing a draft Mental Health Bill to modernize the Mental Health Act. It is also investing £122m to roll out a vital NHS England service, providing those who receive mental health support with employment advice to help them stay in work or return to the job market more quickly. The promotion of good mental health and wellbeing should be high on the agenda for businesses, health providers and their insurers.

While treatments do exist, finding an alternative long-term solution is big business, particularly where existing psychotherapeutic or psychopharmacological treatments or therapies are not working, for example, for those suffering from treatment-resistant depression.

Many stakeholders in the life sciences industry believe that psychedelics could be the solution.

PSYCHEDELICS — WHAT ARE THEY?
Psychedelics, also known as hallucinogens, are a class of psychoactive substances that produce changes in perception, mood and cognitive processes. Many occur naturally in trees, fungi, seeds and leaves, while others are made synthetically in laboratories. Examples include LSD¹, Psilocybin², DMT³, MDMA⁴ and Ketamine⁵.

Their use as a medical treatment for mental health issues has lain dormant for decades due to prohibitions based on their classification as illicit substances and stigma. However, with legal restrictions easing and attitudes changing, the interest of the biopharmaceutical industry in their potential has reignited. Clinical investigations are increasingly being allowed to take place on their use for the potential treatment of addiction, depression, anxiety, anorexia, post-traumatic stress disorder (PTSD) and even migraines and autism.

Ketamine is the first psychedelic to be approved as a medical treatment of mental health conditions. It faced fewer legal restrictions and regulatory hurdles than other types of psychedelics as it had already been authorized and available as an anesthetic medicine. Against this background, a Ketamine-derived treatment has already been approved for use by the FDA for treatment-resistant depression. Some psychiatrists and treatment centers also offer its off-label use.

Many other promising treatments are in the pipeline.

CLINICAL TRIALS RESEARCH
While pre-clinical research and clinical trials on many psychedelic drugs are still at an early stage, the initial results announced by various biopharmaceutical companies are promising:

• In August 2022, the JAMA Psychiatry Journal published the results of a double-blind randomized clinical trial6 conducted on 93 patients with alcohol use disorder (AUD) all receiving psychotherapy. It concluded that the percentage of heavy drinking days during 32 weeks of follow-up was significantly lower in the groups who received psilocybin (9.7%) than in the group who received an active placebo (23.6%).

• In May 2022, Compass Pathways Plc presented positive data from a large randomized, controlled double-blind Phase IIb study of its COMP360 psilocybin therapy with 233 patients showing that a single 25mg dose, in combination with psychological support, showed a “highly statistically significant reduction in depressive symptoms” after three weeks (p<0.001)⁷, with a rapid and durable response for up to 12 weeks. This study was published in The New England Journal of Medicine on November 3, 2022, confirming that 29.1% of participants were in remission by week three⁸.

• In May 2021, a landmark study by researchers at Imperial College London’s Centre for Psychedelic Research directly compared the antidepressant effects of psilocybin and a selective serotonin reuptake inhibitor (SSRI) antidepressant. The data demonstrates that psilocybin could match the antidepressant effects of the SSRI and suggested that it may produce a deeper and faster effect. Since the trial involved only 59 people, much larger and longer trials are required.

• In May 2021, the Multidisciplinary Association for Psychedelic Studies (MAPS) released the results of its phase 3 clinical trial of MDMA-assisted therapy for patients with severe, chronic PTSD. MDMA was paired with rounds of psychotherapy. After three sessions, 32% of users given a placebo no longer qualified for a PTSD diagnosis. But for those given MDMA as well, that percentage was 67%. MAPS is currently sponsoring the second of two Phase 3 trials to support FDA approval of MDMA.

• In February 2021, a Phase IIa study of MDMA for AUD, again carried out by Imperial College London⁹, proved safety and high efficacy in a small group of patients, with 75% showing continued improvement nine months later, compared to just 21% in a control group receiving standard addiction treatment. Awakn Life Sciences has acquired the rights to that research data and are progressing into Phase IIb.

The investment into psychedelic research shows no signs of slowing down, with further studies being carried out globally by numerous biomedical companies, including Cybin Inc.’s Phase I study into its proprietary DNT molecule (CYB004) for the potential treatment of anxiety disorders.

LEGAL RESTRICTIONS ON USE OF PSYCHEDELICS AS ILLICIT SUBSTANCES
Legal access to psychedelics for therapeutic purposes is limited, largely because their use remains heavily restricted or in some instances prohibited based on their classification under illicit drug regimes, though there are some exceptions, such as psilocybin’s (often in the form of ‘magic mushrooms’) classification outside the prohibited drugs regime in Jamaica, Portugal, the Netherlands and in some U.S. and Canadian states.

Clinical research has also been impeded by the costs and long delays imposed by such regulations outside the illicit drugs regimes. Stakeholders in the industry, including leading psychiatrists, have been calling for their re-classification outside the illicit drugs regimes so that research may be conducted more easily and that certain psychedelics may be legally prescribed and supplied by pharmacists and doctors in limited settings.

It seems that governments worldwide are starting to take notice.

IN THE UK
The use and possession of most psychedelics in the UK (including psilocybin, MDMA, LSD and DMT) is restricted based on its current classification as a Schedule 1 substance. These are substances that are defined as illicit drugs under the Misuse of Drugs Regulations 2001, with the exception of Ketamine which is Schedule 2. Schedule 1 is the most tightly controlled class of drug in the UK, other examples being some fentanyl opioids and crack cocaine, and cannot be lawfully possessed or therefore used (including as legitimate medical treatment via prescription) in the UK without a Home Office personal license, which is a license granted to an individual to be carried on a person without risk of prosecution for a drug offence under the Misuse of Drugs Act 1971.

A Home Office “controlled drug licence” (domestic) is generally required for the production, possession, or supply of controlled drugs and a register is used to record details of any such drugs received or supplied by a pharmacy. While the Schedule 1 classification does not prevent research or clinical trials, it does make legitimate scientific and medical research difficult to conduct due to costs and time frame restrictions.

Nevertheless, attitudes are changing towards psychedelics and support is growing for their reclassification:

• The Conservative Drug Policy Reform Group (CDPRG), whose members include Conservative MP Crispin Blunt, is campaigning to have psilocybin reclassified as a Schedule 2 drug so that it can be easier, cheaper and quicker to facilitate clinical trials. This means that it would fall into the same category as medicinal marijuana, which became permissible to prescribe due to a reclassification under the controlled drugs regime in 2018.

• In May 2021¹⁰, a poll carried out on 1,763 members of the UK general public found that 55% would support relaxing research restrictions on psilocybin and 59% would consider psilocybin-assisted therapy if offered to them.

• In 2021, the then Prime Minister Boris Johnson indicated that the government was working with the Advisory Council on the Misuse of Drugs to consider whether barriers to legitimate research on controlled drugs, including psilocybin, could be removed.

Notwithstanding these developments, progress has been slow.

IN THE U.S.
In the U.S., most major psychedelic drugs, with the exception of Ketamine, are unable to lawfully be used based on their classification as ‘Schedule 1’ substances under the Controlled Substances Act of 1970¹¹. This is the federal U.S. drug policy that provides the regulation of the manufacturing, importation, possession, use and distribution of drugs deemed to have no medical value or a high potential for abuse.

However, the legal landscape is changing, with many psychedelic treatments currently undergoing clinical trials and advancing through the U.S. Food and Drug Administration (FDA) review and approval process, e.g. for the use of MDMA and psilocybin in psychedelic-assisted psychotherapy. It is expected that many of these will be approved for the treatment of various psychiatric illnesses over the next few years.

More recently, on July 13, 2022, two amendments were passed in the U.S. House of Representatives allowing the provision of psychedelic-assisted treatment to veterans and active duty service personnel who suffer from PTSD.

Various U.S. jurisdictions also passed laws, at state and local levels, to reduce criminal penalties relating to their use:

• In November 2020, Oregon was the first state to legalize psilocybin. Starting on January 1, 2023, psychotherapists in Oregon will be allowed to treat their patients with psilocybin.

• A number of U.S. cities, including Denver and Detroit, have eliminated or restricted criminal penalties for the use and possession of some psychedelics.

CANADA
Most psychedelics, including psilocybin and LSD, are impermissible to use legally based on their categorization as Schedule III controlled substances under Canada’s Controlled Drugs and Substances Act (CDSA), though MDMA and ketamine are listed under Schedule I¹².

All of these substances are generally prohibited unless used by an authorized person or an exemption is granted in limited circumstances. For example, a qualified investigator may possess a restricted drug for the purpose of conducting clinical testing or laboratory research in an institution, or the Minister of Health may grant an exemption if the substance is necessary for a medical or scientific purpose or is otherwise in the public interest¹³.

However, in January 2022, Health Canada¹⁴ amended its rules¹⁵ to allow practitioners to request limited patient access to certain psychedelic drugs for any serious, life-threatening or treatment-resistant condition. More recently in October 2022 it was announced that Alberta will be the first Canadian province to allow the use of psychedelic drugs solely for therapeutic use. Under the plan, Psilocybin, MDMA, LSD and Ketamine amongst others will be used as a treatment for psychiatric disorders.

Prior to this, the government had granted only very limited access to psychedelics for illnesses such as late-stage cancer. For example, in August 2020 an exemption was granted for use of psilocybin to assist with anxiety and depression in four Canadian patients receiving end-of-life treatment.

This recent shift, which may have been prompted by the legalization of cannabis in 2018, is perhaps a signal that the government acknowledges the therapeutic benefits of some psychedelics.

We continue to keep a close eye on developments.

POTENTIAL LIABILITIES
As with any new product, it is important to assess the potential liabilities arising from the use of psychedelic drugs so that these can be minimized and the necessary precautions taken.

Professor David Nutt, Edmond J. Safra Professor of Neuropsychopharmacology and director of the Neuropsychopharmacology Unit in the Division of Brain Sciences at Imperial College London has stated to us that “the treatment model is very different from traditional mental illness treatments in that the drugs are given just once or twice rather than daily for months or years. This massively reduces patient exposure to the medicine and is likely to reduce adverse effects.”

With this in mind, we set out our thoughts on liability below:

Clinical trials: The usual risks arising in the context of clinical trials will apply equally to psychedelics, such as the potential for adverse effects and failure to adequately treat or report those effects. Batches should be manufactured in an appropriately controlled environment and doses should be administered (and effects monitored and treated) by adequately trained and qualified medical staff.

Capacity to consent: While all drug recipients should go through an informed consent process, special care should be taken with those who may suffer from more severe mental conditions, for example, suicidal tendencies, psychosis or delusions, to ensure that they have sufficient capacity to understand and agree to the administration of psychedelic treatments, whether during clinical trials or otherwise.

Appropriate treatment settings: Given their hallucinogenic properties, the administration of psychedelics in an appropriate setting is important to support a positive experience. Patients may be exposed to greater risks of harm or an exacerbation of symptoms if used in unregulated settings without the supervision of trained practitioners and appropriate preparatory therapy sessions. Failure to identify pre-existing mental health conditions and acute risks such as suicidality and psychosis may also place patients at higher risk of harm. Should a patient then be injured in such circumstances, the supplier or prescriber of the treatment may be at risk of a claim.

Warnings: It is important that users are fully informed about their use in order to minimize the risk of injury. Instructions for Use (IFU) should clearly set out warnings about (i) potential adverse reactions, side effects, risks and contraindications, (ii) appropriate usage and dosages, (iii) the environment in which drugs are to be administered and by whom and (iv) procedures for before, during and after administration of the medicine (i.e. observation of the patient for several hours after administration etc).

Post-market surveillance: As the long-term effects of psychedelics are relatively unknown, post-market surveillance will be essential to identify any unexpected adverse effects or unexpectedly high rates of certain effects.

Controlled use: In the event that psychedelics are rescheduled, drug agencies and industry stakeholders will likely be keen to ensure that appropriate restrictions apply to their sale, distribution, provision and use, in order to restrict potential misuse. It is likely that only medical practitioners and other properly licensed persons and entities (with appropriate insurance in place) will be authorized to supply, prescribe and administer them in the short-term.

Potential for wider distribution: There is the potential for psychedelics to be made more widely available should the medium to long term results prove favorable and there is an appetite for this treatment as a solution to the growing mental health crisis. As with any product that is widely distributed, this increases the potential for more product and personal injury claims against manufacturers, importers, prescribers and medical professionals and other stakeholders.

Appropriate insurance coverage should be acquired for all these circumstances.

INSURANCE CONSIDERATIONS
The market for insuring life science products is currently robust, with many insurance companies competing for opportunities. Identifying the right type of coverage for pharmaceutical products can present some challenges, typically characterized by the varying levels of liability limits, scope of coverage, deductibles and premiums available from insurers. The appetite for certain kinds of product exposure will also vary between insurers, which certainly appears to be the case for psychedelic products.

The most common insurance policy addressing the potential liabilities arising from product use is product liability insurance. This is widely available from the insurance market for exposure to patient injury arising from clinical trials and commercial product sales. Not all product liability policies are alike with each having nuanced language that may work for or against the policyholder, for example, exclusions for the U.S. Drug Enforcement Administration¹⁶ Schedule 1 products, under which some psychedelics may fall. Despite this, some insurers have already been gravitating towards underwriting psychedelic products, though this is very much an emerging market.

Many companies in the psychedelics space are start-ups focused on attracting high quality board members, resulting in a strong need for directors and officers (D&O) liability insurance. Until 2020, the D&O insurance market had little interest in these companies, which resulted in low coverage capacity, high retentions and extremely high premiums. However, over the past 18 months, insurers have gained a better understanding of the associated risks and have since been attracted to the space, as demonstrated by an increase in coverage capacity, and reduced retentions and premiums by up to 50% and 45% respectively.

FUTURE
Larger scale and longer term trials are required to further investigate the safety and efficacy of psychedelic treatments. However, given their preliminary promise, many are hopeful that they may be the solution to the burgeoning mental health crisis, which is costing the global economy and health insurance industry billions every year. We will very much be staying tuned in.

REFERENCES
1 LSD (or Lysergic acid diethylamide) is entirely synthetically made and was first produced in 1938. It was studied in the 1950s and 1960s, but was banned in the U.S. in the late 1960s despite some promising initial research. It is still classified as a Schedule I drug by the FDA.
2 Psilocybin is a naturally occurring substance produced by over 200 species of mushroom. It has been decriminalized in several U.S. cities, including Denver, over the last few years.
3 DMT (or Diemethyltryptamine) can be synthesized in a laboratory or found in plants. It has been used in psychedelic rituals and practices across South and Central America for many centuries.
4 MDMA (or 3,4- Methylenedioxymethamphetamine) is a synthesized drug and was first produced in 1912. While it is not a classic psychedelic (as it does not produce traditional hallucinatory effects) it is known to induce euphoria and increased sociability. The drug known as ‘ecstasy’ is MDMA cut with other compounds.
5 Ketamine was first synthesized in 1962 and is primarily an anesthetic (and so legally available), though can produce psychedelic effects. It was the first psychedelic to be approved for the treatment of mental health conditions. The ketamine-derived nasal spray Spravato, sold by
Janssen Pharmaceuticals, Inc, was licensed for treatment-resistant depression by the FDA in 2019.
6 The study (whose lead author is Michael P Bogenschutz) was conducted at the NYU Grossman School of medicine and the University of new Mexico Health Sciences Centre.
7 P<0.001 is less than 1 in 1000 chance of the results being wrong
8 https://compasspathways.com/compass-pathways-announces-publication-of-phase-2b-study-of-comp360-psilocybin-therapy-fortreatment-resistant-depression-in-the-new-england-journal-of-medicine/
9 BIMA (Bristol Imperial MDMA in Alcoholism Study)
10 Psilo Nautica & Drug Science Paper on ‘Public Attitudes to Psilocybin-Assisted Therapy’
11 Title II of the Comprehensive Drug Abuse Prevention and Control Act of 1970
12 Schedule 1 substances are deemed to have the highest potential for abuse and impose higher penalties, followed by Schedule 2 and so on.
13 Under Section 56 of the CDSA
14 The department of the Canadian Government responsible for national health policy
15 The Food and Drug Regulations and the Narcotic Control Regulations
16 Drug Enforcement Administration

Multi-factor authentication (MFA) increases an organization’s security and helps mitigate risk by requiring a user to provide multiple forms of identity verification to gain access to an application or website.

How It Works

Once MFA is in place, users will simply log into their accounts with one extra step. There are various forms of multi-factor authentication. Common methods include the use of a one-time code, a pre-determined security question, biometric identifiers, a standalone app or a secure token.

Why MFA Is Important

Now that 80% of breaches are the result of compromised credentials, MFA adds an extra layer of defense that makes it more difficult for cyber criminals to use stolen passwords to access a network.

MFA also provides an extra layer of security for remote workers and helps protect against employees’ poor password habits. Since human error is a major threat to cybersecurity, utilizing MFA is a simple action to help organizations reduce their risk.

Conner Strong and Buckelew’s Cyber Portal has additional resources on MFA. Contact your account representative to learn more about our cyber services or to help setup your cyber portal account.

It’s tempting to click on the “remind me later” button when it comes to installing software updates on your computer but doing so can leave your system susceptible to cyberattacks. Software and application updates frequently contain “patches,” which are used by developers to fix known system issues or add new features. Security patches reduce vulnerabilities by correcting potential points of entry into your system, helping your organization reduce its security risk.

A consistent IT strategy aligned with both a view to cyber security risks and the conditions of your cyber liability program are vital. Failure to align may result in not only increased vulnerability but also impact how your insurance policy responds. A 2018 study by the Ponemon Institute found that over half of all data breaches can be attributed to poor patch management.

Here are 3 Patching Best Practices to help improve your overall cyber hygiene and keep your organization safe:

1. Install updates quickly: When updates become available, don’t delay. As soon as patches are released and vulnerabilities are exposed, threat actors know exactly where to target your systems.
2. Automate patching: Automated patching tools continually scan for missing patches and updates, which increases speed and efficiency of patch deployment and minimizes the time you are vulnerable. Additionally, there is less possibility for human error, as IT teams don’t need to constantly stay on top of patch releases. Some software even contains the option to prompt you to install updates automatically whenever an update is released.
3. Test patches before rolling out fully: When patches become available, start with a small group of your systems to make sure everything runs smoothly. Additionally, create a system backup before making any changes, to protect your data in the event there is an issue with patch installation.

For more information on patching and cyber security, please visit Conner Strong and Buckelew’s Cyber Portal. Contact your account representative to learn more about our cyber services or to help setup your cyber portal account.

TREND: INCLUDING CHANGE MANAGEMENT WITH TECHNOLOGY IMPLEMENTATION
For emerging technologies to make a difference, they need to be used. Many companies are supplementing technology solutions with change management programs or focusing on delivering solutions promoting behavior changes, especially using gamification techniques. InsurTechs are beginning to emphasize people and processes as much as the technology itself.

What It Means For You
Whether your company is implementing operational or client-facing technology, a focus on change management could have a positive impact on adoption and utilization and your ultimate ROI. For example, in the telematics space, one company is working with existing telematic solutions to improve driver engagement by creating incentive programs. Another company is using technology to develop highly personalized incentives for employees to increase healthy behaviors to create a happier, healthier, and more productive environment.

TREND: BIG DATA IS DISRUPTING THE UNDERWRITING PROCESS
Is disruption by data an asset or a liability? The evolution and availability of new data continue to disrupt traditional insurance underwriting, particularly with catastrophic perils and cyber coverage. In addition to more competition with alternative risk programs, including parametric solutions, we are seeing insurance providers, both established and emerging, consume massive amounts of structured and unstructured data to refine underwriting appetites and models.

What It Means for You
Insureds must be prepared for the good, the bad and the ugly of big data. The insights uncovered from new data sources and algorithms could have a positive or negative impact on rates, limits, retentions and coverage terms agreed to by insurance markets. Understanding the extent of data that is used, controlling the “story” behind the data and leveraging new or alternative insurance products available in the marketplace will be key to managing risk going forward.

TREND: AS RISKS EVOVLE, SO ARE INSURTECHS
It’s clear that the risk landscape is changing as a function of greater societal, economic and environmental shifts. Whether stemming from climate change, digital-forward lifestyles, a focus on inclusion and equity, and so forth, the traditional approaches to evaluating risk and prioritizing company values are being challenged.

What It Means for You
The concept of what is an insurtech will expand as the nature of risk expands and may deliver more value now that company stakeholders, including the next generation of workforce and consumers, are demanding companies prioritize areas such as sustainability, wellness and flexibility as much as the bottom line. Companies should be utilizing innovative technologies and platforms as a tool for managing emerging risks, including their ESG strategy.

A Glimpse into the Future – Insurance in the Metaverse
Artificial intelligence, machine learning and robotic process automation are swiftly shifting from “emerging” to “essential” technologies; how quickly will the insurance industry adapt to transacting in cryptoassets? Or providing comprehensive coverage for NFTs? Or conducting business via avatars? We are excited about all these opportunities, which may come sooner rather than later, and how they will enable us to better serve our customers in a changing world.

Poor password security practices continue to be one of the leading causes of data breaches, with over 80% of breaches attributed to stolen credentials [1]. Creating strong and secure passwords is your first line of defense against cybercriminals and is essential to reducing your organization’s risk.

Here are five password management best practices:

• • Every password should be at least 12 characters long and should be unique and complex, using a combination of special characters, numbers, capitalization and punctuation
  • Never share your password with anyone else
  • Use different passwords for each account
  • Implement multi-factor authentication
  • Use a password manager

With the average person having over 70 passwords, a password manager is an effective tool to safely manage online credentials. A password manager is a piece of software on your phone, tablet or computer that helps generate strong passwords and safely stores them. Password managers only take a few minutes to download and are easy to use. To keep this tool extra safe, secure it with multi-factor authentication (MFA).

Conner Strong and Buckelew’s Cyber Portal has additional tools, trainings and resources to help keep your organization safe. Contact your account representative to learn more about our cyber services or to help set up your cyber portal account.

[1] Verizon. Data Breach Investigations Report, 2022.

More than 90% of successful hacks and data breaches start with phishing scams. Phishing is a threat to every organization across the globe. That’s why it’s important to get the information you need to prevent attacks.

Phishing attacks are meant to look legitimate, with the intention of deceiving to obtain private information, or to plant malicious software into your network. Often via email, criminals send messages featuring poor grammar and misspellings, urgent language, and suspicious links or attachments. The sender relies on the reader quickly overlooking these red flags to ensure the success of their attack.

Preventing cyber claims begins with employee training. An overwhelming number of claims start as phishing attacks, evolving into business email compromise, wire transfer fraud and ransomware. If you receive a suspicious email, follow your organization’s procedures, alert your IT department and delete the message from both your inbox and deleted folder.

To show your employees what to be on the lookout for, be sure to share ‘Don’t Get Phished! Tips to Keep Your Company Safe.’ To learn more about our cyber services and resources available on our Cyber Portal powered by NetDiligence, contact your Conner Strong & Buckelew representative.

By Joe DiBella, Executive Partner, National Employee Benefits Practice Leader at Conner Strong & Buckelew 

With prescription drug prices continuing to grow, employers and plan sponsors are seeking new ways to combat rising costs without impacting their members.  

Americans spend more on healthcare than any other country in the world, primarily due to the extremely high cost of prescription medications. While prices are not rising as quickly as in prior years, prescription drug costs have still increased 2.5% since the beginning of the COVID-19 pandemic. Since 2014, prices have risen an astonishing 35%.  

Specialty pharmaceutical costs are a significant driver of these increases. Specialty pharmaceutical prescriptions accounted for a staggering 51% of total pharmacy spending in 2021. This is even more surprising considering only 2% of the population uses them.  

In light of these trends, employers and plan sponsors facing rising costs are being forced to react. As such, pharmacy coalitions are rising in popularity – and for good reason. Joining them is one of the most effective steps organizations can take to keep spending on pharmaceutical drugs in check. 

Benefiting From Economies of Scale 

Pharmacy coalitions are groups of employers, plan sponsors, and other large purchasers of prescription drugs that have banded together to gain purchasing power and negotiating strength. By aggregating members, they’re able to place large orders of prescription drugs at a time, thus commanding more competitive pricing than if a single organization were to negotiate a deal alone.  

Typically, these coalitions bring together thousands or even millions of members to vastly improve their negotiating positions. These savings are passed on to plan sponsors and employers. As a result of the stronger negotiating power, greater purchasing power, and competitive pricing that comes with joining a coalition, these partnerships can save employers and plan sponsors up to 25 percent of their annual pharmacy spend.  

This pricing power is even more valuable today as pharmaceutical drugs have become more commoditized. In an attempt to minimize disruption to their members, employers and plan sponsors are often reluctant to make changes to their benefits plans. Yet most of the time, members won’t see any of their pharmacy benefits change and will face little to no disruption in their health plan at all after joining a coalition. They’ll still be able to access the medications they need, just at better prices.  

Maximizing Your Participation 

Aside from greater pricing and purchasing power, joining a pharmacy coalition with the support of an experienced insurance broker can come with many additional benefits that can help employers and plan sponsors further reduce their overall pharmacy costs.  

For example, coalitions often come with custom preferred medication lists that help members avoid low-quality, high-cost drugs when superior, less-expensive alternatives are available. Integrated patient assistance programs that facilitate appropriate medication use among members are also often provided through prescription care management programs. These high-touch patient and physician medication management programs have been proven to drive better outcomes for patients.  

Employers and plan sponsors should also ensure they receive access to custom data reporting and analytics that can help them identify medication management opportunities. National pharmacy pricing transparency tools, like GoodRx, can also come in handy for patients making decisions about which drugs to purchase and where to find the best price.  

Employers and plan sponsors will want to ensure they join pharmacy coalitions that provide these benefits in addition to greater purchasing power. Selecting a coalition that works best for the organization is best accomplished alongside a knowledgeable insurance broker that understands the landscape and can help them make the best decision based on their needs.  

Continued Cost Challenges 

Unfortunately, prescription drug prices aren’t likely to come down anytime soon. As new sophisticated specialty drugs continue to come to market and drive up overall pharmacy spending, employers and plan sponsors should consider acting as soon as possible. Pharmacy coalitions are great places for these organizations to start. They’re a fit for nearly any organization with more than approximately 250 employees and can provide valuable purchasing power that translates to thousands of dollars in savings each year. They offer very little disruption to members and should be considered by almost any employer or plan sponsor seeking greater control of their pharmacy spend.  

 Partnering with knowledgeable and experienced insurance brokers can help these organizations get the most out of their participation. At Conner Strong & Buckelew, we offer our employee benefits clients access to these coalitions and support their participation by offering a world-class clinical team, including clinical pharmacists that will strategize overall pharmacy design and analytics.  

There’s no reason to overpay for prescription drugs.  

Reach out to us today to see how power in numbers can lower your overall prescription drug costs.  

By Laura Kerns

Even with increased cyber awareness, threat actors continue to gain access to companies’ networks through human error. Employees may click on a link in a phishing email or threat actors may gain access through passwords found on the dark web. Once they gain access to the network, threat actors use existing email rules and forwarding to monitor client and vendor communications, obtain banking & wire transfer information, and collect personal identifiable information (“PII”). If email rules are not monitored, a cybercriminal may remain in a company’s system, undetected, for an extended period.

WHAT ARE EMAIL FORWARDING RULES?

Email Forwarding Rules allow an email account user to automatically redirect incoming emails to a separate account. This feature is a convenient tool for users and is utilized often in a business setting. For example, if a person will be out of the office for vacation or an extended period, they may forward their emails to a colleague in their absence. Cybercriminals use this feature to forward incoming emails to a separate folder or email account. Not only does this provide the attacker with intelligence for a subsequent broader attack, but it may also provide the cybercriminal with PII of other potential victims. In addition, the cybercriminal may have access to the emails even if the user turns on multi-factor authentication (“MFA”) or changes their password.

WHAT IMPACT COULD EMAIL FORWARDING RULES HAVE ON YOUR BUSINESS?

Once a threat actor gains access to a company’s email system, commonly referred to as a Business Email Compromise (“BEC”), they may access PII of your employees, vendors, and clients. Compromises may require forensic investigation to determine what individuals and regulators will need notification. BECs can be expensive and detrimental to a company; this is often only the beginning of a larger attack.

WHAT MAY HAPPEN NEXT?

• Ransomware: Cybercriminals now have access to a company’s network and could launch an attack.
• Wire Transfer Fraud: A threat actor may create a new email address or an email domain name so close to your company’s domain name that the vendor/customer may not notice. They may create a rule that forwards any emails containing keywords (e.g., bank, transfer or wire) to a new email address. They may use these to direct wire instructions. The email may even include a signature line with a phone number directly to the threat actor for verification.
• Disrupt Relationships: Threat actors may gain additional emails to vendors, clients, and customers for phishing campaigns allowing you to inadvertently serve as a catalyst for further attacks within and without your business network causing damage to relationships and potential liability issues.

HOW CAN YOUR COMPANY AVOID THIS TYPE OF ATTACK?

Cybercriminals continue to grow in sophistication. Companies can improve their defenses through detection and prevention.

• Be sure to implement employee cyber training on at least a quarterly basis.
• Determine if your business really needs email forwarding, disable if possible.
• Be sure your IT department is auditing logs to review existing email forwarding rules. Investigate suspicious activity immediately.
• Have users encrypt sensitive information to provide an extra layer of security.