Category Archives: Emerging Risk

Игроки всегда ценят удобный и стабильный доступ к играм. Для этого идеально подходит зеркало Вавады, которое позволяет обходить любые ограничения, обеспечивая доступ ко всем бонусам и слотам.

Identifying and Preventing Provider Fraud in Workers Comp Cases

Posted on by

Claimant fraud and premium fraud are two of the most well-known types of workers compensation fraud. In these cases, a worker may intentionally fake an injury (claimant fraud) or a business owner may misrepresent their employee headcount or incorrectly classify employees to obtain lower insurance premiums. Now, a lesser-known type is occurring with greater frequency: provider fraud.

Provider fraud occurs when a professional other than the injured worker or employer accepts a bribe or illegal kick-back in exchange for patient or client referrals. The circle of potential culprits includes lawyers, translators, doctors, chiropractors, nurses, and telehealth professionals. Opportunity, incentive and rationalization—the “fraud triangle”—are key factors that go into a person’s decision to commit insurance fraud. These factors have been exacerbated in recent years, due in large part to the pressures presented by the global pandemic and the growing reliance upon remote services.

Most schemes involve knowingly billing for medical goods and medical and legal services that are unnecessary or not provided at all. A chiropractor, for example, conducted illegal medical evaluations and billed these evaluations, claiming that he was approved as a medical legal evaluator. In another example, an attorney named his daughter as the owner of a translation services company, while in reality he maintained ownership of the business. Each time the attorney was hired, the translation business was also engaged and billed its services. Provider fraud is increasingly prevalent in California and Florida due to each state’s workers comp rules. For instance, in California, a provider can file their own lien with the Workers’ Compensation Appeals Board, even if the bill was denied. California is the only state that allows providers to file their own adjudication. At a higher rate than in other states, healthcare providers in California and Florida are sometimes found billing for services that were never rendered, billing for more expensive services than were actually provided, ordering unnecessary tests or procedures, and providing kickbacks to referring physicians.

So, how can we pin down provider fraud?

  • Review Provider Invoices and Reports: Risk professionals can spot potential fraud cases and fraud trends by closely reviewing provider invoices and reports and scrutinizing those invoices that are close to, but not at the top of, typical billing charges. In the workers compensation system, there are typically five levels of a doctor evaluation: Level 1 is the cheapest while Level 5 is the most expensive. Fraud often occurs in Level 4 billings since Level 5 would be too obvious. Providers who consistently bill at Level 4 could be a red flag for fraud.
  • Shine a Spotlight on Supplementary Services: Insurers sometimes overlook that provider fraud can occur with supplementary services such as translation and transportation companies, copy services, medical equipment suppliers and pharmacies. It is not uncommon for insurers to discover that these schemes may involve a criminal enterprise (possibly a referral network) orchestrated by individuals who are not medical or legal professionals. While claimants can be complicit, often they are unwittingly involved and potentially subject to treatment that is unnecessary or even harmful. 
  • Consider Emerging Tech to Pinpoint Provider Fraud: Artificial intelligence and machine learning are game-changers for fraud investigations. Through the analysis of historical claims data and insurance adjuster notes, some technologies can help professionals discover fraudulent claims faster. For instance, AI can be particularly effective at the entity level when a doctor or hospital that is identified as fraudulent can be added to a “bad actors” list for review in future claims. If you do not have a fraud feedback loop, start gathering information now. As risk and insurance professionals, we rely on business rules and claims adjusters to catch all the details of a claim and then form a cohesive narrative to investigate. While business rules work, the fraud feedback loop is necessary to effectively train machine learning models to detect patterns and flag anomalies.

Workers compensation insurance provider fraud has become a multi-billion-dollar industry that is bad for business. It is costly for insurance companies to identify and prosecute, it inflates costs for goods and services that honest business owners rely on, and it stokes consumer apathy and distrust in the insurance system. Risk and insurance professionals need to be aware of the warning signs so they can work diligently to detect and prevent it.

4 Steps to Help Organizations Embrace Risk from Emerging Technology

Posted on by

As companies continue to navigate the changing work environment brought on by the pandemic, it has become clear that business leaders will need to get comfortable revising and adapting their strategies to deal with disruption brought on from new technologies and new regulation. As risk management professionals, these rapid changes have made our job more important than ever to our organizations.

online pharmacy sildalis with best prices today in the USA

Yet the majority of our organizations—particularly in C-suites—remain far from giving risk management experts the seat at the table they need to effectively safeguard against enterprise threats, digital or otherwise.

Data from PwC’s Global Risk Survey 2022 shows that executives are starting to recognize these risks: 79% of executives report that they view the breakneck speed of digital transformation as a significant risk management challenge. Moreover, this renewed focus is translating into increased funding, as 65% of organizations are increasing their spending on risk management technology and 56% said they planned to invest in risk culture and behavioral risk in 2022.

online pharmacy mobic with best prices today in the USA

Unfortunately, the survey also found that too many organizations are treating the risk function as an add-on or incorporating risk leaders into strategic conversations too late. Only 39% of business leaders reported adding risk professionals to decision-making processes early, which should be an essential step for executives seeking to minimize risk from the outset. On a broader scale, executives seemed to lack confidence in risk managers, with only 47% of respondents saying they feel “very confident” in their risk function’s ability to build a more risk-aware culture, a key element of any successful risk-focused company.

Particularly as companies invest in emerging technologies, business leaders need to listen more to their risk and compliance functions and integrate them into conversations about how those technologies will be implemented. Artificial intelligence is a great example: when companies rush to implement systems to accelerate efficiency and analyze trends, they risk creating disproportionate bias and violating personal privacy through data sourcing. Risk professionals need to be at the table from beginning to end to make sure that an evolving regulatory environment and other pitfalls are fully accounted for in the organization’s implementation process.

While investment in risk management technology is helpful, it is insufficient without making structural changes to the organization to prioritize the risk function company-wide. Particularly as companies consider adopting emerging technologies, the following steps should be considered not just by risk management professionals, but across the C-suite:

  1. Identify, categorize, and prioritize technology risks across the company. This should be done on a regular basis by a dedicated risk management team, married with the best tools available, with findings routinely reported back to senior leaders. Companies are on the right track here: 65% plan to increase their technology spend this year across data analytics and process automation to support detection and monitoring of risks. This initial step will lay the framework for the establishment of cyber threat intelligence, systems monitoring, and incident response protocols.
  2. Adapt IT governance to the emerging technologies being adopted. Risk professionals should work with IT teams and company leadership to create governance structures that integrate seamlessly with corporate strategy, allowing for alignment of day-to-day operations, effective decision-making, a framework for best practices, and promotion of investments that enhance business objectives.
  3. Update leadership often on the emerging tech regulatory landscape. Whether across data privacy rules, cyber reporting requirements, or other complex technology challenges, a robust compliance program should keep leaders across the company updated as new technologies are implemented. Otherwise, companies risk run-ins with legal authorities and the erosion of trust from their clients and customers.
    online pharmacy cymbalta with best prices today in the USA

  4. Set expectations with leadership that not all risks are one and the same. Understanding the context around each piece of technology will become imperative to understanding its specific risks and the appropriate response strategy, including the maturity and complexity of the business processes to determine true risk to the company. Inherent in this case-by-case evaluation is an understanding of the company’s risk appetite and criteria for acceptable level of risk.

When adopted purposefully, emerging technologies can make companies more efficient, more profitable, and better stewards for their employees, clients and communities. Risk is often unavoidable for early adopters of emerging technologies, but it can be mitigated if C-suites equip their risk functions with a holistic strategy and a voice in key business decisions. As C-suites and organizations seek to adapt to a changing world, their success will hinge on the extent to which risk management is incorporated into their strategies.

3 Things Every Organization Should Do to Protect Against Cybercriminals

Posted on by

Cybersecurity should be a top priority for organizations today, especially as employees continue to work remotely without business-grade protections. In the age of COVID-19, businesses are more vulnerable than ever. Whether it is phishing scams or malware, hackers are constantly finding new ways to attack businesses. In fact, in March 2020 alone, scams increased by 400%, and have continued to increase since then.

It is vital that employers protect their organizations and employees from cyberattacks, especially now. As new scams develop, businesses must create new ways to stave off hackers. Many steps can be taken to implement—and enforce—security measures as part of daily procedures for employees. By focusing on just three strategies, organizations can help better protect themselves from phishing scams and other cyberattacks.

1. Create a Comprehensive Plan

As organizations transitioned to remote work, employers had to make foundational shifts to adapt. The same is true for security threats. Cybersecurity measures need to become part of everyday routines and tasks. This means creating a plan to protect all assets and boost security in business processes.

Each organization’s security strategy also needs to align with its specific business risks. Performing risk assessments will allow employers to determine where they need to invest in cybersecurity. It is important to identify key digital assets within networks and personal devices so that employers can determine how to best protect them.

Once an organization’s risks are assessed, it can create a plan to suit these needs. For example, a cybersecurity strategy may include secure remote access or virtual private networks (VPNs), especially for virtual workers, to protect devices from threats posed by public internet connections. Other strategies include implementing multi-factor authentication, assigning access permissions to employees and maintaining regular backups.

2. Prioritize Investments in Cybersecurity

Protecting an organization requires the proper tools. A trustworthy security framework is a vital aspect of managing risks. For many remote or hybrid workplaces, areas like cloud and or software as a service (SaaS) security are top of mind. To manage and protect these environments, organizations should shift to software-defined networking (SDN) with secure access and/or secure service edge capabilities.  

Firewalls are also an important aspect of security, as they place a barrier between trusted internal networks and the outside world. Maintaining end-to-end security has become even more difficult in the age of remote work.

Investing in threat-monitoring and endpoint protection tools can also help. While there is no silver bullet to combat the myriad threats, layering cybersecurity methods helps create “defense in depth,” better positioning the organization to face whatever specific cyberrisks may be exploited next.

3. Take the Time to Train Employees

Strategy and security are futile without proper training. Organizations must commit to continuously training employees so that they are not only aware of what cyberattacks to watch for, but what to do if they notice something. This means ensuring that employees are comfortable reporting scams. By starting training during onboarding and conducting it regularly as scams evolve or emerge, workers can shift from liabilities to assets.

Cybersecurity training ranges from phishing testing to password and device management. Employers must teach workers to update their systems, be cautious with external devices like flash drives, and practice physical device security.

Reaction is just as important as prevention. Organizations should have a plan for employees if they fall victim to a scam or notice something unusual so IT or information security professionals can solve the issue as quickly as possible and mitigate the damage.

Ignoring cybersecurity is a huge risk, as cyberattacks can have serious consequences for businesses and their customers, suppliers and partners alike. It is critical to develop a strong cybersecurity strategy and invest in resources and training. Security is continuing to increase in importance as remote work remains and threats rise. By understanding the issues, challenges and potential threats of a cyberattack, organizations can determine what steps and precautions can be taken to decrease the likelihood of a cyberattack in the future.

Cyberrisk Management Tips for Businesses Amid the Russia-Ukraine War

Posted on by

A wide range of risks are trickling down from Russia’s assault on Ukraine, from sanctions compliance to supply chain disruption to business interruption. Cyberrisk has also drawn considerable concern and the threat landscape continues to evolve rapidly, though the details of increased cyberattack activity are not yet fully known and may be largely unfolding below the surface right now. Attacks attributed to Russia have been launched against a range of targets in Ukraine, including new destructive malware campaigns, targeted information-gathering against a range of civilian and government targets, and attacks on critical infrastructure.

Concerns about escalating cyber activity around the crisis are a vivid reminder of the importance of knowing your threat model and adjusting your risk management priorities accordingly. According to experts ranging from independent cybersecurity professionals to officials at the Cybersecurity and Infrastructure Security Agency (CISA), organizations at greatest risk right now include critical infrastructure, banks and other financial services firms, and of course key service providers in Ukraine or Russia.

Spill-over to other businesses is more likely with cyber conflict, however, particularly given Russia is one of the most advanced and aggressive nation-state cyber threat actors—remember the crippling global attack known as NotPetya that upended supply chains in 2017 resulted from a Russian cyberattack on Ukraine. That is not to say that there is necessarily cause for panic, simply that the effects of cyber conflict can be unexpected, widespread and potentially severe.

At this point, for most companies that are not in a high-risk position as a direct result of the war, the best course of action for risk professionals is to focus on ensuring your company has an updated and detailed incident response plan on hand and distributing it to relevant members of the organization, reviewing and potentially strengthening your general cybersecurity posture, and reminding employees about cyber hygiene.

For example, given the tragic events and breaking developments around the conflict, many may be glued to news or social media. Unfortunately malicious actors are known to take advantage of such situations by posting phishing links on social media with alleged news updates or email scams that purport to collect charity donations. Remind employees about these perils and offer refreshers on how to spot phishing scams and the need to exercise caution with links in emails or on social media.

“In addition to taking a fresh look at plans and other policies within an organization’s cybersecurity risk framework, businesses should consider a few common-sense tips to prepare for a potential cyber incident,” advised Annmarie Giblin, partner at Hinshaw & Culbertson and leader of the firm’s data privacy and cybersecurity practice. Giblin recommended risk professionals take the following steps to boost cyberrisk management efforts right now:

  1. Print out a hard copy of any necessary polices and plans, like the cyber incident response plan, the business’ cyber insurance policy and a contact list for the organization, so you have them available in the event you cannot access your system and need to communicate with employees through alternative methods.
  2. Remind your employees about common cyber scams and reiterate that there will be no retaliation for reporting a cybersecurity mistake, such as clicking on a bad link.
  3. Have key members of the executive team and incident response team set up a secure but alternate method of communication, such as sharing phone numbers or creating a different off system email address to communicate in the event the business’ systems are not available or not trusted.
  4. Keep track of the latest threats and get the research over to your IT team so they can update your firewall, and/or contact the business’ security services provider and make sure they are aware of and addressing these new malware strains.
  5. Evaluate and if possible, test your business continuity plans. Organizations should be asking themselves, “What does the work day look like without access to the business’ systems?” and “How can we still work without any technology support?”

Cyber insurance firm Coalition has put together a guide to basic cybersecurity measures to help organizations—policyholders and otherwise—proactively manage cyberrisk and reduce the likelihood of a cybersecurity incident. The guide provides 10 key steps to help improve cyberrisk management, highlighting the basics of each mitigation measure, tips on how to implement, and even some vendor suggestions for credible options, if desired. Coalition notes this may be particularly helpful for small and mid-sized businesses that do not necessarily have dedicated in-house information security experts, but it could also be worth a look for any risk professional who wants an overview of mitigations that should be in place or ways to fill those gaps. Check it out here: https://info.coalitioninc.com/rs/566-KWJ-784/images/DLC-2020-12-2021-Coalition-Cybersecurity-Guide.pdf

For more resources on cyberrisk management best practices, cyber incident response, cyber insurance considerations, and more, check out Risk Management Magazine’s extensive cyber coverage here. Some of the highlights below can help address key concerns that you—or your board—may have right now, and offer actionable strategies to strengthen your cyberrisk readiness and boost employee cyber hygiene: