Security breach adds fuel to fire over credit-based insurance scoring.

The recent breach of security at data broker ChoicePoint Inc. has added fuel to the fire in the debates over use of credit-based insurance scoring and loss-history reports in insurance underwriting.

Nearly all insurers use ChoicePoint to get credit-based insurance ratings information and loss-history information. ChoicePoint offers three insurance claims information databases called Clue Auto, Clue Property and Current Carrier. These comprehensive loss underwriting databases are full of people's personal information.

Overall, ChoicePoint has 19 billion public records in its databases.

Late last year, Georgia-based ChoicePoint and Californian authorities discovered that con artists had used stolen identities to create what appeared to be authentic business documents in a successful bid to appear as legitimate small businesses wanting to access ChoicePoint's databases. These fake businesses were able to pass ChoicePoint's customer authentication process and then accessed databases containing names, addresses, Social Security numbers, driver's license numbers, abbreviated credit reports and other information such as bankruptcies, liens, professional licenses and real property data. About 145,000 individuals have had information accessed and at least 750 have been defrauded.

"I think this points out another problem with credit scoring: the data people have isn't safe," said Birny Birnbaum, executive director of the Texas-based Center for Economic Justice. "People can get a bad credit score because of identity theft."

Birnbaum, an outspoken opponent of insurance scoring, said it should not be used in underwriting because "it has nothing to do with the consumers' financial behavior and everything to do with the arbitrary nature of credit scoring. "And the ChoicePoint incident underlines this argument, he said.

Robert Hartwig, senior vice president and chief economist for the Insurance Information Institute, said insurers are fight to look at it with concern as well. "The issue here is one of confidentiality. We are concerned that this breach of security occurred" he said.

ChoicePoint said the insurance-related databases were not compromised by the fraudulent activity. The insurance databases only can be accessed by insurance companies with certified A.M. Best Co. numbers. More than 95% of auto insurers use Clue Auto, which contains up to five years of auto claims history, names, dates of birth, policy numbers, date of loss, type of loss, amount paid and vehicle information.

Birnbaum said the fraud points to a system where insurance companies are relying on data that isn't secure and it shows the unfairness of the insurance-scoring system.

Hartwig, however, said while the breach of security raised concerns about confidentiality, it does not mean that opponents of insurance scoring are right. Hartwig said if erroneous information is found in a credit score or report, there are measures in place to challenge and change that information.

The National Conference of Insurance Legislators is drafting a model law that would prohibit taking adverse action based solely on claims/loss history and prohibit using prior claims experience more than five years old, among other possible provisions. The NCOIL model law is in response to concerns over the use of loss-history reports.

ChoicePoint has reacted to the fraud by beefing up its security measures, including rescreening 17,000 business customers, according to news reports. The company also has hired a retired Secret Service agent to rework its verification process. Access to Social Security numbers, drivers' licenses and dates of birth also now will be limited to customers sponsored by a public corporation or government agency.