Skip Ribbon Commands
Skip to main content
Skip Navigation LinksAsk Tim
Ask Tim

Quick Launch


 About Tim


Officially the Assistant Vice President of Research, Tim is our self-proclaimed "Insurance Geek."  As one of our most recognizable names and utilized resources, he helps members every day with technical questions.

IIABNY > Ask Tim
October 01
Insurance Agents: Stop Issuing Certificates of Insurance


Disclaimer: The following is my opinion only. I do not speak for my employer or its board of directors.

Just before I left work one night last week, I got my ear roasted again by an insurance agent frustrated about certificates of insurance. I don't know how many calls I get each week about certificates, but they come in often enough.

According to a 2011 article by Bill Wilson of Big I Virtual University, it costs an insurance agency $7 to issue an ACORD certificate without any customization; adding custom language or terms may double that cost. An agency insuring one middle market construction account that needs 100 certificates annually will spend between $700 and $1,800 to produce those certificates.

The cost goes beyond paper or data entry. It includes time that staff spends fielding the requests, producing the certificates, forwarding them to a third party, fielding the objections from the third party, working with insurers to get demanded coverage changes, responding to the third party and the insured when the insurer refuses to make the changes, listening to an angry customer threaten to take his business elsewhere, listening to the third party insist that none of the other insurance agencies are being a problem about this, and so on and so on.

On top of that, certificates of insurance are the basis for a large percentage of errors and omissions lawsuits against agents. They are probably responsible for more E&O legal actions than any other single cause.

So, issuing certificates of insurance costs agencies hundreds of dollars (dollars that come out of commission income; in New York, agents cannot charge service fees), and they make it more likely that an agent will end up in court. Knowing this, why on earth do agents continue to issue them?

I think they should stop.

That's right. I think they should notify their clients that it is agency policy not to issue certificates of insurance, other than in situations where state law requires them (New York Workers' Compensation Law requires one form for work with government entities.) The clients should in turn notify their customers or, if they won't do it, the insurance agency should. It's time to stop the madness.

Here's what I think should happen. When an agency lands a new client who may need to give a third party proof of insurance, the agency should ask the client to sign a document. That document would give the agency permission to post the client's policy declarations and forms on a secure web site. It would also give the agency permission to make those records available to third parties who want proof of the client's insurance. This could be done with a password or an encryption key that changes regularly, or some other security mechanism.

The third party would then have the ability to review the client's policies and determine for themselves whether the policies meet contract requirements. They could compare the contract requirements to policy terms and conditions and determine if there is a shortcoming. When there is a coverage deficiency, the third party could notify the client, who would then ask the agent if coverage can be added. Then the agency would go to the insurer, as it would for any other coverage request.

Here's the deal. Right now, clients give agencies fat construction contracts and tell them to figure out what insurance is needed. However, if agents had gone to law school, they would be lawyers, not agents. They don't have the legal education to properly interpret contracts, and they should not have to. Nor should they have to endure threatening statements from third parties who do not contribute a nickel of revenue to the agency. Every day, some certificate holder tells a contractor to get a new insurance agent, one who will be "easier to do business with." It has to stop.

I have a broker's license. You know what? I have absolutely no desire to become an insurance producer because I hear too often about how much time producers waste dealing with certificate demands. Producers go into this field to make money and to help people solve their risk management problems. They don't go into it to argue endlessly about a piece of paper that some people want to transform into a contract. But that's how they spend their time.

No, thank you.

I don't know enough about anti-trust law to know whether it would be permissible for all agents to collectively stop issuing certificates. That is why I'm speaking for myself, not my employer. I do not for one second want to suggest that they favor an action that may be illegal. However, in my ideal world, certificates of insurance would be banished from the risk management world within the next half hour. Issuing them ceased to be a value-added service a long time ago. Now it is just assumed that an agency will issue hundreds of these things and deal with the inevitable arguments for zero additional compensation. It's not right, and agents should not put up with it any longer.

Stop issuing certificates of insurance. Today.

September 09
Where To Find ACORD 855 NY

Photo by J.D. Hancock. Used under a Creative Commons Attribution 2.0 license.

I got a phone call from a member while I was driving to work this morning (disclaimer: I have hands-free access in my car), and it got me thinking that some New York insurance producers need more information. As I've reported in this space before (and discussed in a July webinar,) ACORD introduced a new form specific to New York last May. The form is New York Construction Certificate of Liability Insurance Addendum, form number ACORD 855 NY (2014/05).

Since ACORD launched the form for use, I've received a number of inquiries from members wanting to know how they can get a copy. This morning's caller asked if she should go to the Web site of the New York State Department of Financial Services to get it. This told me two things, one of which I already knew: 1) Agencies are not yet able to download the form from their agency management systems, and 2) some are under the misimpression that the New York State government created and is mandating this form.

To be clear, the NYSDFS had nothing to do with the creation of this form. Zippo. I assume they now know that it exists, but that's the extent of their involvement. ACORD created this form at the behest of several private organizations (IIABNY among them) because of conditions in the New York construction insurance market. True, state law (primarily the scaffold law) is a major influence on those conditions, so one could say that the state government indirectly influenced the form's creation. Members have also reported to me that at least one state government agency is now requiring contractors doing business with it to submit the addendum. However, it is simply incorrect to say or believe that this form came from the DFS. It didn't; it came from ACORD and a bunch of organizations who are trying to get some control for insurance producers over the proprietary certificate forms that different entities have foisted on us over the years.

Compared to many other states, New York taxes more and regulates more. There are many things we have to do in business, especially the insurance business, for which we can truthfully say, "The state is making me do this." The ACORD 855 NY is not one of them.

Any ACORD form user can download forms from ACORD's Web site. For less than $200 a year, agents can join the ACORD Advantage program and gain access to enhanced fillable forms. If your agency has an agency management system, that system may provide you with access. If it's not making available forms you need, such as the ACORD 855 NY, contact the vendor and tell them you need it.

Just don't go looking for it on the DFS Web site. You won't find it there.

September 03
Cavalcade of Risk #216: Workers' Comp, Cat Losses, Kayaks, and Did a Doctor Prescribe That Joint?


I am very happy to host the end-of-summer issue, #216, of Cavalcade of Risk. The CoR is a bi-weekly roundup of blog posts on all things insurance and risk management. There's a lot of interesting stuff in this issue, so read on.


In the first of three posts related to Workers' Compensation in this issue, Julie Ferguson of the Workers' Comp Insider blog relays mixed news: As a percentage of employers' covered payrolls, Workers' Comp costs rose in 2012, but they remain below historical levels.

On the Workers Comp Roundup blog, Michael Stack discusses why employers who fixate on serious injury losses may be overlooking a bigger problem for their experience modifications - frequent, small medical-only losses.

Robert Wilson wonders whether the days are numbered for the basic principle that Workers' Compensation should be the exclusive remedy for injured workers. Writing at the From Bob's Cluttered Desk blog, he also casually throws in a Big Bang Theory reference. In my mind, this automatically making his a blog worth reading.

Claire Wilkinson over at Terms + Conditions reports that weather conditions in the U.S. produced three of the five largest insured catastrophe losses in the first half of the year. And remember, at this point in 2011, Tropical Storm Lee had not yet occurred, and at this point two years ago Superstorm Sandy was more than six weeks away.

If you insure any high-net-worth personal lines clients, then you'll want to check out R.J. Weiss's report on the six mistakes these clients tend to make with their coverage. Read all about it at The Illinois Insurance Protection Blog.

At the Health Business Blog, David Williams warns states that have legalized marijuana for medical use to expect sellers to also market the drug for recreational use. The three bullet points near the end of his post should be the starting point for a lot of discussion on this issue.

Think someone stealing your credit card numbers is the biggest online threat you have to worry about? Hank Stern at InsureBlog reminds us that, "Most identity theft in the United States is medical-related." Ask your health care providers if they are implementing either of the solutions he suggest.

Last and least, on this blog I address an IIABNY member's question about whether a commercial property insurance policy should have covered the loss of three stolen kayaks. Is a kayak a vehicle? The answer to that question determines the coverage.


Thanks for dropping by the Ask Tim blog for this issue of Cavalcade of Risk. I hope you find the posts thought-provoking. Should you feel so inclined, leave some comments on them or share them on Twitter, Google Plus, LinkedIn, or whatever your preferred social network happens to be. Rebecca Shafer of Workers' Comp Roundup will be your host next time with more interesting reading from the risk management world.

August 28
Two Minutes With Tim - the Transporation Industry Workers' Compensation Trust

IIABNY members have been asking about the status of the assessments against members of this trust. Here's the story.

August 25
Watch This Video About Ridesharing

​I've posted a few times about ridesharing services (you can relive the glory here and here.) Ridesharing is just starting to creep up as an issue in New York, but I think it will grow bigger in the future. If you're not familiar with services like Uber and Lyft, I recommend you watch this 14-minute documentary. Chances are that some of your clients are either already doing this or are thinking about it. They might not have the insurance coverage they think they have.


August 15
College and Coverage: What Could Go Wrong?

(This post previously appeared in the Aug. 14, 2014 issue of IIABNY Insider.)

“I suppose I could collect my books and get on back to school.” – Roderick David Stewart, “Maggie May”

It’s already mid-August. The New York Jets have finished up their training camp in Cortland and are headed down I-81 toward East Rutherford (the Giants, of course, have forsaken Albany and stayed home.) The New York State Fair opens next week. The stores are alive with back-to-school sales. That weeping and moaning you hear is coming from … teachers.

Yes, faster than you can say “dining hall food,” it will be time for the younger set to head back to schools and colleges. And that means it’s time to think about insurance. Why? Because it’s always time to think about insurance. Here are some insurance issues to discuss now with your personal lines clients who are parents of college students:

The Basics: Do the Parents’ Policies Cover the Student?

Probably yes, though it depends on the student’s enrollment status and age. The ISO Homeowners 3 Special Form (HO-3) policy covers a student enrolled in school full-time, as defined by the school, who was a resident of the named insured’s household before moving out to attend school, provided the student is under the age of 24 (if the student is the named insured’s relative) or 21 (if the student is in the named insured’s care or the care of a relative who resides in the named insured’s household.) The ISO Personal Auto Policy automatically covers residents of the named insured’s household who are related to the named insured by blood, marriage or adoption, including ward or foster children. There is no age limit, but the individual must reside in the named insured’s household.

Homeowners Insurance

Coverage for Personal Property in a Dorm or Apartment

Does the parents’ policy cover it? Yes, but the ISO HO-3 caps the amount of coverage at 10 percent of the limit of liability for Coverage C or $1,000, whichever is greater. For example, if the policy declarations show a limit of $100,000 for Coverage C, the student’s property is covered for up to $10,000.

Is there a way to buy more coverage? Yes. ISO endorsement HO 04 50 05 11, Increased Amount of Insurance for Personal Property at Other Residences, increases the limit of liability up to a stated dollar amount for property at a residence scheduled on the endorsement. An additional premium applies for every $1,000 in additional coverage.

Don’t forget that college textbooks, which now cost as much as a good seat at Yankee Stadium, are covered personal property.

Computer Coverage

What is it? ISO endorsement HO 23 13 05 11, Special Computer Coverage – New York.

Why buy it? The unendorsed ISO HO-3 covers an insured’s personal property, but only for specified causes of loss. It will cover a stolen laptop, but not one that gets dropped, gets fried by a power surge, or that gets a (ahem) beverage spilled on it. This endorsement changes coverage for computer equipment to include special causes of loss. Some carriers may also apply a reduced deductible to computer equipment.

Coverage for Damage to a Dorm Room, Dorm Furniture, or Apartment

Does the parents’ policy cover it? Yes, but only for a few causes of loss. The Property section of the HO-3 policy does not cover damage to non-owned premises at all. The Liability section covers the insured’s liability for damage to property rented to, occupied or used by or in the care of an insured only if the loss is caused by fire, smoke or explosion. Coverage does not apply to any other cause of loss. If Joe College consumes one too many Dr. Peppers and uses a dorm couch as a trampoline, thus causing it to crumble, there is no coverage. If he lives in an apartment and, while channeling his inner chef, torches the building beyond recognition, the loss is covered.

Is there a way to buy more coverage? ISO does not offer any endorsements to broaden the coverage. Some insurers might have proprietary forms or endorsements. However, even if the loss is covered, we need to talk about …

Limits of Liability

What’s the problem? The basic limit for Personal Liability Coverage is $100,000. If Joe fries his building crispy, the landlord will have some thoughts about the cost of rebuilding and lost rents. How large will that bill be? Probably a whole lot more than $100,000.

What’s the answer? A higher Personal Liability limit. The good news is that, to quote the British tunesmith Yusuf Islam (nee Cat Stevens), “The first cut is the deepest.” According to ISO rules, the premium increase for going from $100,000 to $200,000 is 15 percent; the cost of going from $100,000 to $500,000 is 35 percent. Five times the coverage for 35 percent more money. Not so much a bad deal. And let’s not overlook an umbrella policy, such as the RLI Personal Umbrella Policy offered through IAAC, IIABNY’s member services division. This leads us to another subject of an umbrella policy …

Auto Insurance

Limits of Liability

What’s the problem? Every parent’s worst nightmare is the phone call late at night announcing that a child has been in a car accident. If your son or daughter is behind the wheel at the time, he or she may have legal liability for injuries to other victims and property damage. New York law doubles the liability limits on a personal auto policy for deaths resulting from a car accident. For example, if the limits are $50,000 for injuries to one person and $100,000 for injuries to multiple people, those limits become $100,000/$200,000 in the case of death. It’s not hard to imagine that $200,000 getting exhausted pretty quickly when there’s a car full of kids.

What’s the answer? Same as above – higher limits and an umbrella. And a whole lot of hope and prayers that they’re never needed. On a related note …

No Fault Insurance – Limits of Liability

What’s the problem? The basic New York no-fault insurance endorsement provides $50,000 in first party benefits for medical expenses, work loss and related expenses. Medical expenses alone can chew up $50,000 pretty quickly, especially if surgery is required.

What’s the answer? The Additional Personal Injury Protection Coverage – New York endorsement, ISO endorsement PP 05 88 01 14, increases first party benefits to $100,000 or more. Many insurers offer up to $150,000, but New York law does not specify a maximum limit, so they are able to offer more. The cost of additional PIP coverage may be surprisingly low.

Heading back to college brings mixed feelings for students and parents alike. Students because the carefree days of summer are over but they get to see their friends again. Parents because they are saying goodbye again to their children while saying hello again to lower grocery and laundry bills. We all hope that the students have a safe and educational school year. If something goes wrong, though, you will rest easier knowing that you discussed these options with your clients.

July 24
Is a Kayak 'Covered Property'?

 Does Commercial Property Insurance Cover.png

 Photo by Jonathan C. Wheeler. Used under a Creative Commons Attribution 2.0 license.


Question from an IIABNY member: I have attached pages 1 and 2 of the ISO Building and Personal Property coverage form (CP 00 10 06 95). Our question pertains to “Property Not Covered”, specifically item A.2.o. on page 2. This clause states that vehicles and self- propelled machines that are licensed for public road use, or operated principally away from described premises, are not covered property. Our question is whether or not non-motorized kayaks are considered “vehicles”, and therefore are not “covered property”.

Our insured had three kayaks stolen. They were not in the water when stolen. They were temporarily away from the insured premises, on dry land. Insurer is denying coverage under A.2.o, claiming that the kayaks are vehicles principally operated away from the described premises, and therefore are not “covered property”.

There is coverage included for business personal property away from premises (The policy in question includes a limit of $500,000 for Business Personal Property that is temporarily at a location not owned, leased, or operated by the insured).

A kayak is watercraft, but not self-propelled. We believe the wording of A.2.o. is intended to make a distinction between “vehicles” and “self-propelled machines.” We also think the intent of the wording “including aircraft or watercraft”, which is in parentheses after “self-propelled machines”, is intended to apply only to self-propelled machines, not to vehicles. In other words, only self-propelled watercraft that is operated principally away from premises are “property not covered”. At least this is the way it has always been explained to me and the way I have seen it interpreted by insurance companies the past 30 years.

The insurer disagrees. They feel that all watercraft including kayaks are “vehicles”.  They feel that paddleboards, surfboards, inflatable floating lounge chairs or rafts, boogie boards, inner tubes, & other such personal floatation devices are “vehicles” because they can convey persons or property from point A to point B. Following that logic almost any property that a person could use to convey themselves or their property on land or in the water, which is used primarily away from their premises, would be considered a “vehicle”, which I don’t believe is the intent of 2.A.o. 

I have never heard anyone in the insurance industry, whether adjusters, or underwriters, even with marine insurance, ever refer to watercraft as a vehicle. Are we wrong in thinking that this loss should be covered under the business personal property away from premises extension, and that these kayaks are not vehicles?  

Answer: This is a tough one, but I think I have to side with the insurer. I will grant you that it splits some pretty fine hairs, but here is my line of thinking.

The provision in question is:

Covered Property does not include: …

o. Vehicles or self-propelled machines (including aircraft or watercraft) that:

(1) Are licensed for use on public roads; or

(2) Are operated principally away from the described premises. 

This paragraph does not apply to: 

(1) Vehicles or self-propelled machines or autos you manufacture, process or warehouse;
(2) Vehicles or self-propelled machines, other than autos, you hold for sale; or
(3) Rowboats or canoes out of water at the described premises; ... 

The form states that Covered Property does not include vehicles or self-propelled machines. Right off the bat it makes a distinction between transportation property that has its own power and property that doesn’t. It implies that “vehicles” are not self-propelled, and the other type of property is.

Your interpretation of the phrase in parentheses is not unreasonable. I think it would have been clearer for ISO to say, “Motor vehicles, aircraft, watercraft, and other vehicles or self-propelled machines …” It is very easy for a reader to conclude that the phrase in parentheses applies to self-propelled machines and not vehicles.

However, since the policy does not define “vehicles,” I checked the dictionary (I’ve read enough court opinions to know that judges often do this to determine a word’s plain and ordinary meaning.) The American Heritage College Dictionary has six definitions of “vehicle,” but only the first is relevant here:

“1.a. A device or structure for transporting persons or things; a conveyance: a space vehicle. b. A self-propelled conveyance that runs on tires; a motor vehicle.”

According to this definition, a vehicle can be self-propelled or not. Using this, a mode of transportation that relies on human power is a vehicle (bicycle, sled, etc.) It follows from this definition that a kayak is a vehicle. It also fits within the second of the two criteria given by the form – it is operated principally away from the described premises.

It’s also worth noting that the paragraph gives coverage back for rowboats and canoes out of the water at the described premises. If ISO did not intend to exclude non-self-propelled watercraft, it would be unnecessary to specifically identify these items for coverage.

Based on this, I believe the denial of coverage was correct. It would be different if the kayaks were for sale – the form clearly includes such items within the realm of Covered Property. If they were not for sale, then coverage does not apply. 

I realize this isn’t what the client wants to hear, but I believe it is the correct interpretation. 

Readers, what do you think? Agree with my conclusion or disagree? Leave your thoughts in the comments. 

July 15
N.Y. Insurers: Follow the Rules for Non-Renewal/Conditional Renewal Notices
Send Notice.png


I turned 53 last weekend. (Insert jokes about old age here.) A few weeks before I turned 25, way back during the Ronald Reagan years, the New York State Legislature passed and Gov. Mario M. Cuomo signed a bill into law. It slapped new requirements on insurers that wanted to cancel or non-renew commercial insurance policies or make major changes to them. No longer could insurers double a business’s premium or exclude important coverage with no advance notice, or non-renew a policy with a month’s notice.
I was an underwriting assistant with a large national insurer group at the time, and I remember what a big deal this change was. The underwriters in my office knew that this would take some getting used to. When I became an underwriter, I also had to work within its confines. It wasn’t always easy, but it was the law. The rules may cause underwriters some additional work they don’t want, but they’re not all that difficult to understand.
This law, New York Insurance Law Section 3426, is now 28 years old, meaning that since its enactment:
  • Three of IIABNY’s employees were born
  • The World Wide Web and DVD technology were invented
  • Four U.S. presidents have been elected, three of them twice
  • Regis Philbin started a syndicated morning TV talk show and retired from it after a 23-year run
  • The insurer groups USF&G, Continental, St. Paul, General Accident, and The Home have ceased to exist.

And yet, even after all this time, too many insurers either can’t or won’t follow this law. It passed the point of being ridiculous a long time ago.

During the past week alone, I have received the following complaints from IIABNY members.

  • An underwriter extended a policy because he sent a late conditional renewal notice. He then told the broker he could just let it expire after the extension period ended.
  • An underwriter issued a renewal policy more than 60 days before the expiration date. Because of this, he believed that he did not have to send a conditional renewal notice about coverage and premium changes.
  • An underwriter believed that he could hike the renewal premium by 17 percent without sending a conditional renewal notice. He had switched the policy from one insurer in his group to another. He believed that this absolved him of responsibility for sending a notice.

I wish I could say that this is a new problem, but it’s not. I receive so many emails about problems our members have with insurers on this, I saved the law’s text as auto-text in Microsoft Outlook. I can insert the text in an email with two clicks of my mouse. It’s saving me a lot of time. I taught a webinar last fall about the law’s requirements. I’ve written several blog posts before this one and even done an episode of my podcast on the topic. I’ve been on this job since May 2002, and I probably got my first question about this law on day two.

Here are the facts from the law itself.

  • It applies to commercial risk, professional liability, and public entity insurance policies.
  • It defines “renewal” or “to renew” as “the issuance or offer to issue by an insurer of a policy superseding a policy previously issued and delivered by the same insurer, or another insurer under common control.”
  • An insurer must provide a written notice to the first-named insured and the insured’s authorized agent or broker if it decides not to renew a policy. It also must provide the notice if it decides to renew with certain coverage changes or premium increases. Otherwise, the policy “shall remain in full force and effect pursuant to the same terms, conditions and rates.”
  • The insurer must send the notice if it wants to change limits; change the type of coverage; reduce coverage; increase deductibles; add exclusions; or increase the premium more than 10 percent (not counting any premium increase generated as a result of increased exposure units, or as a result of experience rating, loss rating, retrospective rating or audit.)
  • The notice must contain the specific reason or reasons for the insurer’s actions; provide the amount or a reasonable estimate of any premium increase; and describe in plain and concise terms the nature of any other proposed changes.
  • The notice must inform the insured and the agent or broker that either may obtain the insured’s loss information from the insurer. The insurer must provide this information within 10 days of a request for it.
  • For most policies, the insurer must provide the notice 60 to 120 days before the expiration date. It must send notices for excess liability policies and policies issued to very large businesses 30 to 120 days in advance.
  • If the insurer sends the notice less than 60 days before the expiration date, it must extend the expiring coverage and rates. The extension must be for 60 days from the date of the notice. The only exception to this rule is if the insurer sends a conditional renewal notice at least 30 days in advance and the insured does not replace the policy. If the insurer sends the notice on or after the expiration date, the insured is entitled to another full year of coverage. This coverage must be at the same terms and conditions of the expired policy and at either the expiring rates or the renewal rates, whichever is less.

Folks, this isn’t that hard. You have to give your policyholders at least two months’ warning if you’re going to drop them, change or reduce their coverage, or hike their premiums. You can’t play cutesy games to get out of it by switching the coverage to another insurer in your group. You can’t just issue the renewal policy two months early and let the insured figure it out. You have to tell them what changed and why, and you have to let them know they can get their loss history. You can’t just let a policy expire.

If this was a new law, I could understand the confusion, but it isn’t and I don’t. If you manage an underwriting team and your people are not fully complying, this is your fault. Don’t rely on a cheat sheet or some other shortcut to educate them; give them a copy of the law. You can download it from the IIABNY Web site. For all that, give them a copy of this blog post. Just make sure they’re following the law.

Yes, it’s a hassle, but it’s part of doing commercial lines business in New York. And lest this start a litany of posts about how New York hates business, be aware that 18 other states also require 60 days’ notice of nonrenewal. Kentucky requires 75 days’ notice, and South Carolina requires 90 days’ notice during hurricane season. More than half the states require at least 30 days’ advance notice of material changes and/or premium increases. New York is not unique in this respect.

This law has been on the books for almost three decades. Every insurer operating in this state should be accustomed to it by now. Stop trying to wiggle your way out of the requirements. It makes you look dishonest, whether you mean it to or not. Educate your underwriters so they know what they have to do. The insurance business is difficult enough for underwriters, agents and brokers without having to deal with easily solvable compliance issues. Follow the rules.

June 10
Determining the Right Cyber Liability Policy for a Client

A convenient follow-up to yesterday's post showed up in my inbox this morning. has a five-minute interview with Chris Christian from US Risk Brokers that is well worth your time. I would especially direct the attention of insurance producers to her comments at the end about whether producers have an obligation to find the right policy for the client when all the client asks for is invasion of privacy coverage. Her point: You may not have a legal obligation, but you have an ethical one. To which I give a hearty, "Amen!"




June 09
New ISO CGL Endorsement Excludes Data Breach Liability

Data Breach.png

Unless you’ve been paying very close attention to policies issued since May 1, you might not have noticed a subtle but potentially significant change in commercial general liability insurance policies based on ISO forms. Starting on that date, a new endorsement must be attached to all ISO CGL policies – CG 21 06 05 14, titled Exclusion – Access Or Disclosure Of Confidential Or Personal Information And Data-Related Liability – With Limited Bodily Injury Exception.

The unendorsed CGL coverage form states that the insurance does not apply to damages arising out of “The loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.” If a business gets sued because of alleged damage to someone else’s data, the policy will not provide coverage. This new endorsement tacks on an additional paragraph to this exclusion. It now says that the insurance does not apply to damages arising out of, “Any access to or disclosure of any person's or organization's confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information.”

Translation: No coverage for you if someone sues you for a data breach. This exclusion applies to both Coverage A (Bodily Injury and Property Damage Liability) and Coverage B (Personal and Advertising Injury Liability.) This prevents an insurer from having to cover a loss that might fit within the policy’s definition of personal and advertising injury. ISO’s explanatory memorandum described the impact of the endorsement this way:

“With respect to bodily injury and property damage arising out of access or disclosure of confidential or personal information, these changes are a reinforcement of coverage intent. As discussed above, damages related to data breaches, and certain data-related liability, are not intended to be covered under the abovementioned coverage part. These types of damages may be more appropriately covered under certain stand-alone policies including, for instance, an information security protection policy or a cyber liability policy.


To the extent that any access or disclosure of confidential or personal information results in an oral or written publication that violates a person's right of privacy, this revision may be considered a reduction in personal and advertising injury coverage.”

ISO rules have made this endorsement mandatory; we should expect the next edition of the Commercial General Liability Coverage Form to have this wording built in. Also, the New York State Department of Financial Services approved this endorsement for use here last December. (The filing is available for download using the DFS rate, rule and form filing search tool. Enter “ISOF-129157450” in the SERFF Tracking Number field.) It should be appearing on new and renewal policies now.

There is a New York legal requirement to keep in mind. New York Insurance Law Section 3426(e)(1) states that a CGL policy issued by an admitted insurer:

“(S)hall remain in full force and effect pursuant to the same terms, conditions and rates unless written notice is mailed or delivered by the insurer to the first-named insured, at the address shown on the policy, and to such insured's authorized agent or broker, indicating the insurer's intention: …  to condition its renewal upon … reduction of coverage … or addition of exclusion …”

It appears that New York law may require insurers to send conditional renewal notices on every CGL policy renewal affected by this change. The notice must “contain the specific reason or reasons for nonrenewal or conditional renewal … and describe in plain and concise terms the nature of any other … changes specified in (the wording quoted above) …” I’m willing to bet that not too many underwriters are aware that the addition of this endorsement might trigger that obligation.

On the other hand, ISO’s response to NYSDFS questions about the filing indicates that ISO does not view this as a reduction in coverage:

“It is important to note that notwithstanding the revisions contained in the referenced filing, there are several current exclusions in the ISO CGL and CLU Coverage Forms that may preclude coverage for records in the custody of an insured. For example, under Coverage A – Bodily Injury And Property Damage Liability, the Damage To Property exclusion provides, in part, that insurance does not apply to property damage to personal property (which could potentially include various types of records) in the care, custody or control of the insured. This exclusion also precludes coverage with respect to property the named insured owns, including any costs incurred to repair, replace or restore such property. In addition, the Electronic Data exclusion as it currently exists in the CGL and CLU Coverage Forms excludes coverage, in part, with respect to damages arising out of the loss of, loss of use of, and damage to electronic data, which also could potentially include various types of records.


With respect to bodily injury and property damage arising out of access or disclosure of confidential or personal information, the changes contained in this filing are a reinforcement of coverage intent. As discussed in the Explanatory Memorandum submitted with this filing, damages related to data breaches, and certain data-related liability, are not intended to be covered under the CGL and CLU Coverage Parts. With respect to personal and advertising injury liability arising out of access or disclosure of confidential or personal information, this revision may be considered a reduction in personal and advertising injury coverage to the extent that any access or disclosure of confidential or personal information results in an oral or written publication that violates a person's right of privacy. It is important to note that other invasion of privacy offenses (i.e., those that do not otherwise involve access or disclosure of confidential or personal information) are not expressly addressed by the exclusions newly introduced in this filing.”

Essentially, ISO is saying that they never intended for the CGL form to cover liability for data breaches, so this isn’t a reduction in coverage. That leads to the question of why it feels the endorsement is necessary. My guess is that the insurers who subscribe to ISO forms have been unnerved (understatement) by some of the damages resulting from these breaches and want the policy to plainly state that there is no coverage. Whether ISO’s arguments about the intent of the form will be enough to absolve insurers of the obligation to send conditional renewal notices is an open question.

I’ll throw that open question to all of you. What do you think – does the law require insurers to send conditional renewal notices on thousands of CGL policy renewals, or do you agree with ISO that the endorsement is simply an affirmation of coverage intent with no real reduction in coverage?

1 - 10Next