The company will incorporate the CCC Secure Share platform announced Thursday into CCC ONE for its 22,000 auto body shop customers.
“CCC’s decision to support the BMS standard is part of our ongoing commitment, and a multimillion dollar investment to better secure data shared through the CCC ONE® platform,” CCC Automotive Services Senior Vice President Joseph Allen said in a statement Thursday. “We built CCC Secure Share using open technology so it would have the dual benefit of providing data security, while enabling new technologies and innovations to connect to the industry and bring new solutions to collision repairers. Our rollout plan is designed to provide ample time for application providers to complete the development needed to connect to CCC Secure Share.”
EMS vs. BMS
The Collision Industry Electronic Commerce Association created the Estimate Management Standard protocol in 1994 to give collision repairers and third-party businesses a single, standard language for their software to “talk” to each other.
The EMS system fulfilled its purpose and was fine for its time, built to deliver dBase files in a largely pre-Internet world. However, CIECA ceased support in 2003 after developing the highly improved and more secure Business Message Suite, which uses the XML format often used today by developers and is now updated twice a year.
Unfortunately, collision repairers are still on the EMS standard today, 13 years after it was supposed to became a relic. CIECA has been imploring collision repairers to pressure information providers for BMS support, and the Society of Collision Repair Specialists has been urging IPs for the same since at least 2008, based on reports in ABRN and Body Shop Business.
Under EMS, all data related to an estimate file is exported to a party (for example, a rental car agency or a parts supplier) who has requested information from a collision repairer — not just the portion needed to accomplish whatever businesses the auto shop needed to transact with that party. In BMS, each party only “sees” what they need to see, and the data’s 128-bit encrypted.
Mark Fincher, CCC vice president of market solutions, said that “the technology just wasn’t quite there” for the IP to switch. However, after studying the issue for the past 18 months, “we felt that this was the right time to do it.”
CCC has kept its cards close to the vest about the change, according to Fincher. Over the years, it of course had floated the idea of switching to BMS to “key strategic customers,” and it shared general details with a few players. But for many companies, “they’ll be hearing it for the first time on Thursday.”
How the data switch will work, be filtered
For collision repairers, the switch should be pretty painless, and preferable to having a bunch of data pumps running in the background or having to manually upload the EMS file to a Web portal, according to Fincher.
CCC will essentially create its own version of the iOS “App Store,” allowing third party developers to create BMS-compatible programs. A shop will select in CCC ONE which companies it would like to receive data, and CCC will handle the back-end of transmitting the particular messages relevant to the company — not all of the nearly 200 messages possible with BMS.
“We’re helping the shops control that data,” Fincher said. He said CCC “defined a series of messages” which would likely be needed for each industry, and only those fields would be transmitted to the third-party companies within that industry.
For example, car rental companies might consistently need a certain combination of the fields transmitted through BMS, while a parts supplier might need a different combination. If a shop decided to start buying parts from a new vendor, it’d select that company’s “app” to receive data. CCC would transmit that block of messages from any future estimates where that vendor was used for parts.
We asked CCC if an “EMS Lite” situation could arise where a vendor didn’t receive the entire estimate, as with EMS, but still saw the block of messages specific to their industry on estimates that didn’t concern them. For example, take a shop that buys parts from a dealership and a salvage yard. If the shop only buys from a dealership for a particular repair, would the salvage yard still see the parts messages from that estimate?
CCC clarified in an email Wednesday:
A unique message will be sent to each third party application. The information provided in that message will be based on the application type. …
If both the dealership and salvage yard were connected directly to CCC Secure Share then each would receive the parts message each time the estimate is saved or locked. This is not a likely scenario. More likely is that a third party application will receive the BMS with all parts and then that third party application will send a purchase order to the dealership or salvage yard based on the shop parts order.
Developers will through the CCC Secure Share website see which messages would be included for their industry, Fincher said. He said shops would likely be able to see and vet such lists as well.
“We haven’t talked about how we would expose that to the shops, but I don’t see any issue with that,” Fincher said. … “That has not been determined yet, but that’s a good idea. We will have some kind of transparency. I just don’t know how that’s gonna be implemented yet.”
A shop will be able to review the industry-specific lists of messages and offer CCC feedback, but it can’t actually configure them to send more data to one partner and less to another. Fincher said a shop only can filter by insurer (which can be done now with EMS), and soon — because of OEM certifications — by vehicle make.
“Today CCC ONE users can filter their EMS output by insurance company,” CCC wrote in an email. “With CCC Secure Share, repairers will be able to filter the information they send to third party app providers by insurance company and vehicle make.”
CCCSecureShare.com is officially live, and third-party developers can begin registering apps.
Sometime between Oct. 1 and Dec. 31, CCC will provide technical documentation for the third-party developers, including which messages would be provided for their industry. Between January and March 2017, the developers can start testing apps through CCC.
In April 2017, Secure Share officially goes live. Shops will be given a password, and can immediately start connecting to whatever third-party apps are available.
“I would anticipate there would be a number of third-party application providers … that would want to be first, and ready to go (at launch),” Fincher said.
At this point, BMS messages are being transmitted, but EMS support will continue, which means a shop can continue to export EMS files as usual to any business partners who haven’t developed a BMS-compatible platform yet.
But that’s inefficient, and means shops are still spraying data to everyone else with a data pump installed on their systems. And so, on April 3, 2018, CCC will sunset EMS exports.
“There’ll be no more EMS output,” Fincher said. Any data pump on your computer can’t pump anything from a CCC estimate. Considering that these third party systems would have known about the sunset date for 19 months, CCC felt it gave them “ample time” to prepare. (And if you think about it, those companies really have had a 15-year grace period considering EMS was supposed to end in 2003.)
If a shop’s business partners were on the ball and all converted to BMS before the April 3, 2018, sunset date, the shop doesn’t have to wait.
“If they want to, they can terminate EMS output on their own,” Fincher said.
Asked if he had a sense of how quickly third-party companies would make the switch, Fincher noted that some of them had been demanding the change “for a long time.”
“We’re hoping that this’ll be received positively by them,” Fincher said. He suggested shops with holdout business partners stress the additional customer data security.
He also pointed out a major business benefit for those companies: Switching grants an automatic foot in the door to all of CCC’s 22,000 shops. You don’t need to install and support data pumps for 22,000 individual shops; just get your app ready to go and CCC handles the rest.
“I’m hoping for new companies as well,” Fincher said.
An innovator with an idea for a collision repair productivity solution might be deterred by not only the archaic dBase format of EMS but also the same logistical hassle of getting a data pump into more than 33,000 collision repair facilities with different computer systems, according to Fincher.
Under the BMS/Secure Share switch, that entrepreneur can program for XML — a fairly easy, common language — and give CCC an app. Their product is now a click away for 22,000 shops; They’ve just got to market it.
CCC won’t open the “app store” to everyone.
“There will be a vetting process,” Fincher said. A dedicated resource will review app submissions for criteria including active CIECA membership. (Technically, developers need that for EMS software, too.)
For shops, all of this is free. If a collision repairer has CCC ONE, he or she will have BMS support and access to all the Secure Share programs automatically starting in April 2017.
Developers, however, will face charges with the conversion, according to Fincher.
“We’re making a significant investment,” he said.
CCC will be processing hundreds of thousands of transactions on a daily basis, “if not more,” he said. It also will develop Secure Share “as a true application” for the providers; the companies will be able to look at usage, for example, and approve or reject shops as trading partners.
“There’s a lot of tools we’re providing on that side,” Fincher said.
CCC will charge a single fee per work file — the numerous transmissions and changes to that file between the shop and third-party company are free, as are all the messages/line items shared within that file.
That fee, however, will be waived through April 2018.
“We want to encourage the third-party app developers to, again, get on board earlier,” Fincher said.
There’s also a registration fee per company, which will waived through the rest of this year. It’s only billed once to a company; they won’t be charged for each app they develop.
Correction: An earlier version of this story mischaracterized BMS encryption. The BMS standard doesn’t produce encrypted messages per se; however, its XML outputs can be easily encrypted by off-the-shelf software for additional security not necessarily possible with the obsolete EMS messaging format. In this case, CCC will subject BMS messages transmitted through Secure Share to 128-bit encryption. The article has since been corrected.
Though insurer and likely repairer information will remain, an upcoming database of “non-included” procedure reimbursement records will redact customer information, National AutoBody Research President Sam Valenzuela…