Risk Financing Strategy for Cybersecurity Compliance at Anthem Blue Cross Blue Shield

Purpose and Background

In 2015, Anthem Blue Cross Blue Shield was the victim of a data breach, compromising the records of over 78 million patients (Wilner et al., 2022). The breach led to a $16 million settlement with the Department of Health and Human Services Office for Civil Rights and an additional $115 million class-action settlement, for a total of $131 million in confirmed breach-related liability (Wilner et al., 2022). These legal defence costs, notification expenses, and remediation figures do not include any other additional financial liability to Anthem. Healthcare breaches are the most costly in any industry, with a 2025 average of $7.42 million (IBM, 2025). This is a huge violation and is still happening with Anthem. This memo reviews the exposure from a risk financing standpoint. It proposes an approach to structuring Anthem's insurance and retained risk and reserves to ensure Anthem is prepared for future losses.

Legal and Ethical Financial Risk Obligations

Under the Medicare Shared Savings Program, Anthem is an accountable care organization that is legally bound to comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule (Edemekong et al., 2024). Such rules mandate constant risk analysis, safety measures for safeguarding protected health information, and prompt notification of any affected individuals in case of a breach. In 2015, companies that failed to comply with these requirements faced regulatory penalties, corrective plans, or litigation, as these events demonstrated. The ethical basis of patient trust at Anthem is characterized as nonmaleficence and beneficence (Varkey, 2021). Nothing about cyber risk is insignificant to Anthem's finances. It must prioritize costs for compliance, set aside sufficient funds for regulatory penalties and litigation, and demonstrate to regulators that it is financially able to respond to a breach in a proper manner.

Strategies for Identifying Risk Financing Issues

Several strategies should be integrated to assess Anthem's financial risk. First, loss projection should develop the likely probability and magnitude of future breaches from internal claims history data and industry metrics like IBM's annual loss costs data (IBM, 2025). Second, a claim settlement analysis should also evaluate the 2015 incident for defence costs, indemnity, and notification costs; this will provide a realistic setting to estimate future losses. Third, an insurance-coverage review should examine current policy limits, deductibles, exclusions, and sublimits to find gaps between what is insured and what Anthem would pay out of pocket. Fourth, a reserve assessment should assess the level of reserves which cover deductibles and excluded losses, and if required, any amount that may need to be remunerated by the insurer. These are actual challenges for the strategies. Prediction of breach impacts is challenging due to rapid changes in attack methodologies, a lack of available financial data to quantify actual breach impact for many breaches for several years after their occurrence, and the difficulty associated with differentiating financial losses covered by insurance from financial losses that Anthem must retain, especially when there are broad exclusions in policies (Tsohou et al., 2023).

Recommendations for Risk Financing Options

First, Anthem must obtain a cyberinsurance policy that is adequate to meet its potential liability, not expect coverage to be transferred from the breach. There are clearly limits to coverage, which will be set against regulatory fines, legal fees and notification costs, as well as limits to any specific policy deductible or any exclusions, and it is becoming more common for insurance companies to seek evidence of specific security control requirements to process a claim (Tsohou et al., 2023). Leadership should ensure that at least multiple quotes are reviewed because priorities should be going to limits that can cover a realistic worst-case loss, exclusions that might leave major cost categories uncovered and deductibles that the organization can cover without disrupting operations. Second, Anthem should set aside a cybersecurity reserve fund to pay deductibles, losses excluded under a policy, and expenses in excess of policy limits. This holds the organization while premiums are being paid and prejudice is being recovered from the insurance company, and it minimizes dependence on General Funds. Insurance transfer combined with a funded reserve offers a more robust financing package than insurance alone.

Key Performance Indicators and Measures

Anthem needs to monitor 5 financial KPIs that relate directly to its risk financing. First, insured loss ratios, which measure the ratio of projected breach losses to current policies' limits of coverage, should be at least 80% coverage by the end of the fiscal year. Second, annual retained exposure, actual dollars Anthem would be on the hook for annually after the proceeds are recovered from its insurer, its deductible, and its exclusions are met. Third, reserve adequacy ratio, that is, a reserve fund balance of 1.0 or higher vs projected retained exposure, within 18 months. The fourth is the premium-to-coverage trend, calculated on an annualized basis as the per cent increase in premium divided by coverage limits, which is calculated quarterly to sense unsustainable rising premiums. Fifth, claims-cost variance, the history of difference between actual claims costs and estimates after a cyber loss occurred, is examined from 90 days after claim resolution. These indicators provide the Risk Management Team with clear and actionable thresholds to evaluate if the financing approach is sufficient for Anthem.

Conclusion

Anthem's 2015 breach settlements show that cybersecurity failures create real, measurable financial exposure. Building insurance reserves is not just about purchasing insurance policies; it is about understanding the policy's terms, including what is covered and what is not, to cover the policy's gap between the risk. The above financial KPIs, together with the actionable steps in this memo, a properly sized cyberinsurance policy, and a reserve fund, provide the RM Team with clarity on how to safeguard Anthem's financial stability. I recommend the team approve funding for both strategies to be implemented in the upcoming fiscal year.

References

   Edemekong, P., Haydel, M., & Annamaraju, P. (2024). Health insurance portability and accountability act (HIPAA). National Library of Medicine. https://www.ncbi.nlm.nih.gov/books/NBK500019/

IBM. (2025). IBM: Cost of a data breach report. Computer Fraud & Security, 2021(8), 4. https://doi.org/10.1016/s1361-3723(21)00082-8

Tsohou, A., Diamantopoulou, V., Gritzalis, S., & Lambrinoudakis, C. (2023). Cyber insurance: State of the art, trends and future directions. International Journal of Information Security, 22(3). https://doi.org/10.1007/s10207-023-00660-8

Varkey, B. (2021). Principles of clinical ethics and their application to practice. Medical Principles and Practice, 30(1), 17–28. https://doi.org/10.1159/000509119

Wilner, A. S., Luce, H., Ouellet, E., Williams, O., & Costa, N. (2022). From public health to cyber hygiene: Cybersecurity and Canada’s healthcare sector. International Journal: Canada’s Journal of Global Policy Analysis, 76(4), 002070202110679. https://doi.org/10.1177/00207020211067946