Colorado Tries to Stop Insurance Discrimination in Age of AI

Insurance is increasingly relying on computers to make decisions that affect people—which means industry regulators must try to understand and prevent discrimination in those AI systems.

Colorado is among the states furthest ahead on regulating algorithmic discrimination in insurance, and officials there are wrestling with thorny questions: What constitutes unfair discrimination when artificial intelligence is making insurance decisions? And how do you measure it without collecting data on the race of policyholders?

The state’s law sets out to protect consumers from unfair discrimination by insurance carriers, and zeroes in on how companies are using the plethora of data available on their customers. The law—passed in 2021—is still being implemented, and next week an industry group will present its proposal to answer the questions about measuring discrimination and inferring race.

It’s industry practice for insurers to not ask people for their race when they apply for a policy. To comply with the law, Colorado insurers will have to guess the race of their policyholders. They’ll probably do that using a method that infers someone’s race based on their name and ZIP code, but that’s still under discussion.

“It’s a technical problem, but really key to getting at the what the statute is all about,” said Jason Lapham, big data and AI policy director at the Colorado Division of Insurance, which is tasked with implementing the law.

“We’re in some ways asking companies to do this to verify, in fact, that what they don’t know is not leading to unfairly discriminatory outcomes,” Lapham said.

‘Unfair’ Discrimination

The other fundamental question the state must address is what qualifies as unfair discrimination.

Insurers “discriminate” with every risk-based decision they make, and much of that discrimination is seen as acceptable—for example, charging higher premiums on health insurance for a smoker or on auto insurance for a 16-year-old driver, because those people are more likely to get sick or crash their car.

But what happens when a car insurer charges higher premiums for policyholders who live in a neighborhood with a high rate of car break-ins—and many of the neighborhood’s residents are Black? It’s difficult to disentangle calculations about insurance risk from the US’s history of racial discrimination in housing, education, and jobs.

For Colorado officials, there’s also a practical, mathematical question: “How then do we measure what an unfair and unfairly discriminatory outcome would look like?” Lapham said. “How do we quantify that?”

The law, SB 21-169, prescribed a stakeholder consultation process that’s still underway. It will apply first to the life insurance industry, followed by auto, and then health insurance.

‘Gold Standard’

The Colorado Division of Insurance’s 2023 proposed rules called for life insurers to estimate policyholders’ race using a method called Bayesian Improved First Name Surname Geocoding, or BIFSG. Developed by the Rand Corp., the method calculates the probability of an individual’s race based on their first name, last name, and ZIP code.

BIFSG is “the gold standard” for inferring race when that information isn’t available, said Elaine Gibbs, the CEO of Bell Analytics, a data science consultancy that works with insurance carriers on AI and bias testing. A version of the method is sometimes used by federal agencies. But it’s never been used in insurance regulation before, several industry groups said in comments to the division last year.

And its accuracy can vary widely, Gibbs said. It does better on estimations about populations than individuals. Error rates will be higher for people living in diverse neighborhoods, or who have changed their name through marriage. Even a person’s age can affect how accurate the results are, Gibbs said, because of different naming patterns across generations.

If the law requires companies to use BIFSG, regulators need to figure out how to incorporate the uncertainty of its results into their calculations, she said, and to answer questions about that uncertainty: “Can we quantify it? And how do we operate knowing that it’s going to be imperfect information?”

Another wrinkle is that some companies subject to the law won’t even have policyholders’ names—such as Verisk Analytics Inc., which is a regulated entity for insurance purposes but mainly operates as an insurance rating bureau, said Stephen Clarke, the company’s vice president for government relations.

Verisk proposed an alternative to BIFSG that it had created, which relies only on geographic data.

It’s unlikely that Colorado will require insurers to begin asking policyholders for their race, Lapham said. He said the division expects the rules to land on BIFSG or a similar methodology.

On Monday, the American Council of Life Insurers will respond to the proposed rules floated last year by the Division of Insurance. The draft rules would have set a standard for measuring discriminatory outcomes and described the method companies should use to guess the race of policyholders. But the industry pushed back on those suggestions, and the state regulator held over those questions to be addressed in later guidance.

ACLI is suggesting that insurers use BIFSG, and also have the option to use other methods with the division’s prior approval—but only if they can demonstrate that the alternatives are more accurate than BIFSG.

Proxy for Race

The Colorado law is concerned with how insurers are using external consumer data sources beyond factors traditionally considered in underwriting—like credit scores, social media history, and biometric data—as factors in their underwriting.

Some data sources insurers may be factoring in do have a strong correlation with race, like credit scores, said Michael DeLong, research and advocacy associate at the Consumer Federation of America, where he works on discrimination in insurance. If a factor is too closely tied to race, it can become a proxy for race, leading to discriminatory outcomes even when insurers aren’t explicitly using race in the underwriting process.

Officials need to come up with a quantitative method for insurers to test whether that data, as well as use of algorithms and predictive models, result in unfairly discriminatory outcomes. For example, do decisions using those factors and methodology result in Black applicants being approved for a policy at lower rates relative to White applicants, or paying higher premiums?

Last fall, the Division of Insurance suggested testing for discrimination in premiums and approval rates separately, looking at differences in non-White versus White applicants’ outcomes. If the insurer found the differences exceeded a certain threshold, they’d then have to test the impact of the external consumer variables they were using.

But industry pushed back, saying that the tests for premiums and approval rates wouldn’t yield meaningful results.

In next week’s presentation, ACLI will suggest the primary test look at the extent to which the predictive power of external data derives from its ability to be a proxy for race. ACLI declined to provide additional comment, referring to their comment letter and proposed draft regulation.

ACLI’s approach gets at the intent of the law, which is to avoid disproportionate racial impacts stemming from the use of external consumer data. But it doesn’t sufficiently address what should happen if insurers fail this initial test, according to University of Minnesota professor Dan Schwarcz, who studies insurance law.

Under ACLI’s proposal, insurers who don’t pass the initial screening would be subject to additional testing and analysis. If they couldn’t prove that the use of an external consumer data variable avoids discriminatory results, they would have to stop using the variable.

The issue with that, according to Schwarcz, is that the statutory definition of unfair discrimination is still too vague.

The Colorado law poses a balancing test, asking whether nontraditional data sources “are not only not predictive of risk, but also potentially predictive of a protected class,” Lapham said—and then whether using that data is a “justified or reasonable” way to predict risk.

Now regulations must define the threshold: At what point does that balance tip, and a factor is too predictive of a protected class to be used in the risk calculation?

“That’s something that we’re still working through,” Lapham said. “That’s the point of continuing the stakeholder process.”