The current disparity of carrier handling of passwords within the real-time environment is reducing the benefits of real-time workflows and is discouraging some agency employees from using Real Time.  In this report, the ACT Real-Time Management Work Group makes the business case for changes in carrier and vendor password handling in the real-time environment based upon new password workflows that some carriers and vendors have already started to implement.

 

Real-time tools in the agency management system or comparative rater create several opportunities for agencies to handle passwords more securely and efficiently, provided the agency has implemented the proper user authentication and security controls in its systems, employee procedures, and physical perimeter. The report lists the many “Pros” of handling passwords in a real-time environment, but also outlines the current “Cons” which are adding inefficiency to real-time workflows and discouraging some agents from using Real Time.

The work group then makes several recommendations for improvement in the handling of passwords in the real-time workflow – most of which are currently being implemented by some carriers and vendors.  The recommendations include:

The work group presents carriers and vendors with several recommended options in recognition of their varying systems capabilities and security policies.  As a result, agents are likely to experience differences in the options their carriers and vendors implement.  The work group encourages each carrier and vendor to implement the set of recommendations that will provide their agents with the greatest improvement in their password handling, consistent with the carrier’s and vendor’s capabilities and policies. 

 

Real Time is a major advance in agency workflow that is increasingly being adopted by independent agencies and carriers because it represents a major advance in “ease of doing business” for both parties.  However, the current disparity of carrier handling of passwords within the real-time environment is reducing the benefits of real-time workflows and is discouraging some agency employees from using Real Time. 

 

In this report, the ACT Real-Time Management Work Group makes the business case for changes in carrier and vendor password handling of passwords in the real-time environment based upon new password workflows that some carriers and vendors have already started to implement. 

 

The work group understands that carriers have different security policies and that each has to balance achieving agent ease of doing business with security needs.  The work group, however, believes that its recommendations can create a “win-win” for carriers and agencies by both increasing agency ease of doing business and the security of agent-carrier transactions.

 

A necessary predicate to the work group’s recommendations is that the individual agency has implemented the proper user authentication and security controls in its own systems, employee procedures, and physical perimeter.   In addition, the particular agency management system or comparative rater vendor needs to have implemented the proper user authentication and security controls in its system.

 

Industry requirements (such as the Payment Card Industry (PCI) Security Standards for credit card merchants) as well as state or federal privacy laws and regulations could limit the applicability of the work group’s recommendations with regard to some transactions.  As is always the case, each organization will make an independent determination as to how such requirements will impact its business processes. 

 

The work group understands that ACT and the industry are exploring digital identity technologies that could create single sign on for agents that would be trusted by multiple carriers for agent authentication.  These digital identities are beyond the scope of this work group and report.  We are focused on improvements in password handling that can be implemented today in the real-time environment.

 

Real Time is the ability for the agent to click on a button from a client file in the agency management system or comparative rater for immediate access to carrier information on that client. The transaction may be a quote, billing inquiry, claim inquiry/loss run, policy view, endorsement or a request for information. This approach provides a single workflow for agent servicing or quoting.

 

Real Time implementation is making great gains within independent agencies and is saving them significant time. A major agency survey conducted by the Real Time/Download Campaign in January, 2008 found that:

User ids and passwords for real-time transactions are maintained in the real-time tool in the agency management system.  This information may be maintained by the individual user or the agency administrator, depending on the agency.

 

When a real-time transaction is performed, the user id and password are passed with the transaction to allow login to the carrier and a result is returned.  This result could be a PDF or other document with the information, or the user is navigated directly to the appropriate screen on the carrier Web site to view the information or complete the transaction.  Real Time tools also permit the agency to do a general login to the carrier Web site without the need to re-enter the user id and password.

 

The Pros & Cons of the Current Real Time Environment

The first three “Pros” for real-time transactions listed above argue for carriers differentiating between the security risks posed by real-time transactions and transactions performed by agency employees directly on carrier Web sites.  The work group believes that carriers should award real-time transactions coming from these approved vendor systems a higher degree of trust than direct Web site transactions and a different approach to the handling of passwords, provided the agency has implemented the proper user authentication and security controls in its own systems and processes as discussed in the “Current Agency Environment” section above.

 

The work group presents carriers and vendors with several recommended options in recognition of their varying systems capabilities and security policies.  The work group encourages each carrier and vendor to implement the set of recommendations that will provide their agents with the greatest improvement in their password handling, consistent with the carrier’s and vendor’s capabilities and policies.