Chief Risk Officer Manoj Makhija provides a progress update on risk management at United HealthGroup in 2017. Customer sentiment shows increasing concerns about data protection following several high-profile hacks. United HealthGroup maintains a strong reputation as one of the most trusted insurers, with no major data breaches reported last quarter. The risk function aims to achieve risk-based decision making, though audits found access control could be improved. Increased regulatory focus on healthcare requires compliance with frameworks like HITRUST, which could boost trust by 15% while resolving prior issues. Questions are raised about potentially adjusting risk appetites for reputation and integrity.

1. United HealthGroup
Risk Management
ProgressUpdate: 2017
By Manoj Makhija
Chief Risk Officer (CRO)

2. CustomerSentiment
• Recent hacks in organizations like
Equifax, Deloitte and ACMC.
• Customers have grown more
concerned about the protection of
their Personal Health Information
(PHI) and Personally Identifiable
Information (PII).
• Company reputation increasingly
depends on the ability to protect
customer data.
• There have been cases where
company’s shares have not been
affected in the long run, but the
reputation has still taken a giant hit.
UnitedHealth
Group
Outcomes of a major incident

3. Business Reputation
• Reputation risk is a major
component of risk management
function.
• United Health Group is now one of
the most trusted Healthcare
Insurer in the country.
• No major complaints of data
breach by customers in the last
quarter.
• As per our survey, 7 out of 10
customers are satisfied with the
privacy measures.
• Only 5 out of 10 customers are
satisfied with the privacy
measures of our major
competitors.
UnitedHealth
Group

4. BusinessOperations
• Information Systems controls
are a big part of operations risk.
• IS controls are aligned with
United Health Group’s business
objectives.
• Risk function is getting closer to
achieve its goal of achieving risk
based decision making in the
organization.
• Audit findings indicate that
access control is an area which
company should focus on to
achieve it’s mission of data
integrity.
UnitedHealth
Group

5. Regulation Reaction
• There is an increase in focus on meeting regulatory requirements in
healthcare.
• HITRUST CSF is increasingly becoming a framework that companies
in healthcare domain are moving to get certified with.
• HITRUST CSF will also resolve issues in access management found by
the external auditors.
• HITRUSTCSF increases a healthcare organization’s trust factor by
15%.
• It is also a one stop framework for other regulatory frameworks like
NIST and HIPAA.
UnitedHealth
Group

6. LegalCompliance
• No fines for compliance of
healthcare laws.
• Compliant with HIPAA and other
health Federal, State and Local
laws.
• Compliance Officer’s report
pointed out the need to hire more
resources to meet the needs for
next quarter.
• Uncertainty on the new healthcare
bill by the republican government.
• Statutory audit was completed last
month with no major findings.
UnitedHealth
Group

7. FinancialWell Being
• Return on Investment on the risk function has increased from
110.23% to 112.65%.
• A total of 53 major breaches were mitigated in the last quarter,
which saved $3 Million worth of PII and PHI.
• More investment needed to improve access control and
compliance additional resource needs.
• It will increase the ROI to 113.17%.
UnitedHealth
Group

8. SomeQuestions
• Do we need a change in risk appetite for business
reputation as it is increasingly becoming a major selling
point in insurance industry?
• Do we need a change in risk appetite for integrity to meet
the industry requirements for having better access
controls?
UnitedHealth
Group