CCC acknowledged and addressed repairer and vendor concerns last month at the Collision Industry Conference but said it was holding firm on its 2018 date to manage estimate data traffic through its in-house Secure Share system — which carries a $0.50/repair order charge for all recipients.
The information provider, whose CCC ONE is used by 19,000 of the 33,000-odd shops in the collision repair industry, announced in September it would in April support the Business Message Suite collision repair data protocol through its Secure Share platform and “sunset” the archaic Estimate Management Standard data standard a year later. The two standards allow collision repairers using one of the estimating systems to transmit data to other business partners’ software.
EMS is old, no longer supported by industrywide standards developer CIECA, and transmits unencrypted all the information associated with the repair. That raises huge shop and customer privacy issues, particularly when vendors install data pumps that can snag any EMS file, even data about a repair in which the vendor wasn’t involved.
A shop sending an EMS file to a vendor has no control over what that vendor does with the data, and there’s no logging to indicate the transaction even happened, according to CCC Vice President of market solutions Mark Fincher. He appeared at the July 25 CIC at the invitation of the Open Systems, Data Access and Sharing Task Force, which was formed out of concerns about the impact of Secure Share. (See task force’s slides.)
“This creates a huge liability for repair facilities,” Fincher said during the CIC session. (See his slides.) He said he gets a call “every two months” from shops asking if CCC had shared their data with a particular company. Fincher said CCC’s answer is no — but check with your other providers to see if they’re the culprit.
The shop might have even cut ties with a vendor but forgotten to uninstall a data pump, he said.
“Now you have complete transparency with Secure Share,” Fincher said.
EMS was also inefficient for shops and vendors, Fincher said. “There’s so many support issues and costs” associated with data pumps, he said, and the shop is tethered to whatever desktop contains the data pumps, preventing the shop from using more convenient cloud-based system.
BMS is modern (XML versus typically dBase IV) and only transmits the data the vendor’s industry segment would need to see, which also makes it more efficient from a computer infrastructure standpoint.
CCC plans with its new Secure Share service to start transmitting 128-bit encrypted BMS messages in parallel to EMS ones in April. Under the program, shops using a kind of “app store” can designate the vendors they wish to receive segment-specific BMS data, and add other filters as well. Vendors sending data downstream to a subcontractor will need to have the subcontractor on Secure Share and approved by the shop as well, Fincher said. (Companies must agree they won’t transmit BMS data somewhere else without going through CCC, according to Fincher.)
In April 2018, CCC EMS exports cease, and the 19,000 shops (out of 33,000-odd industrywide) will use Secure Share to send all estimate-related data under the BMS format. This changes the industry dynamic, as the shops in the past could just give EMS data easily to whomever they wanted by uploading it online or by installing a recipient’s data pump.
After April 2018, vendors who wish to receive that information will have to agree to CCC’s terms to join the “app store” and pay a per-repair fee of $0.50, which will also apply when vendors send BMS data to a third party. (Task force Co-Chairman Dan Risley said CCC isn’t sure about fees with regards to human resources and financial software, such as QuickBooks.)
EMS Audatex and Mitchell estimates can also be imported into the system and exported without a cost to the rival IPs, said Risley, also the Automotive Service Association’s president and executive director. A fee would only occur if a shop attempted to export an estimate started in CCC ONE to one of the rivals.
Fincher encouraged the other two IPs to switch to BMS exports, and CCC wouldn’t pass on fees if one of the other competitors charged CCC for receiving those files.
“We would welcome a similar model to Secure Share,” he said.
Another exception to BMS will be found in the auto parts industries. Recognizing that parts procurement systems might have to cast a wide net for inventory, CCC created a means for them to send suppliers some — but not all — of the data, such as a partial VIN number. There’d be no fee for those limited parts messages, which aren’t BMS transmissions and actually “not even a message,” according to Fincher. This avoids vendors or suppliers eating excessive costs just to see who has a part, and it avoids the hassle of a shop having to approve countless parts retailers just to see who’s selling what. Parts price changes also can be conveyed for free.
CCC’s plan has created concern among vendors — perhaps particularly those in competition with CCC products — and repairers as to the level of control CCC would have and the impact of that $0.50 charge, which will ultimately land on either the vendor, shop, insurer or customer depending on how far it’s passed downstream.
The Collision Industry Conference’s Open Systems, Data Access and Sharing Task Force was created to examine those issues for the industry and has sought answers from CCC. At the July CIC, it declared:
The Database Task Force supports the choice to migrate from EMS to BMS. BMS provides repairers greater control over the data being shared with their strategic partners. Moreover, the Task Force supports the continuation of the unobstructed flow of data amongst all the industry stakeholders. CIECA and other industry stakeholders have established a precedent that facilitates bi-directional data exchange in a free and open marketplace.
Any 3rd party that restricts or prevents industry stakeholders from accessing or using the data generated and permitted by the collision repair facility and industry stakeholders will adversely impact the industry. In addition, it will inhibit advancements in technology, restrict competition and adds cost into the marketplace. Technological advances should enable sophisticated, secure, and more collaborative data usage, not impede industry progress.
It also offered eight suggestions for CCC (Emphasis task force’s; minor formatting edits by RDN.):
1. Delay the implementation of Secure Share until the industry issues are adequately resolved.
2. Allow the industry the option to choose EMS or BMS depending upon business need and business partners.
3. Once the BMS enters the shop’s information system, there is no interruption in business flow as the shop can choose where and with whom they share the data. No downstream restrictions.
4. The shop is provided a comma delimitated, un-encrypted data file to utilize.
5. Allow the BMS file to continue as the EMS file does with the shops’ current process flow.
6. Consider an alternate model and charge for EMS as opposed to BMS usage.
7. Charge a transaction fee when BMS PII (personally identifiable information) is being exchanged.
8. Offer a subscription based fee in addition to the transaction based.
Preparations and workarounds
Some of these suggestions simply aren’t going to happen, based on the CIC discussion. Most notably, Secure Share will not be delayed, and Fincher warned the industry not to wait too long before signing up.
Less than nine months out, fifty companies had registered a collective 57 apps, and seven were live now on Secure Share, able to receive BMS messages from any the 19,000 CCC ONE shops who approve them as a recipient, Fincher said at the July 25 CIC. (If a shop sends data to multiple apps owned by the same company, the parent company only has to pay the $0.50 once per repair order.)
CCC is waiving the fifty-cent fees until it formally shuts off EMS on April 4, 2018, to give the industry time to prepare and give it feedback, according to Fincher.
Fincher said he was concerned that some vendors would wait until the last minute, such as the first quarter of 2018.
“This is going to be a massive implementation for the industry,” Fincher said. He urged shops to start that process now.
“We’ll help you,” he said. “This is a great time.”
If a vendor waits until February or March 2018, CCC might be unable to help the latecomer with the adaption, he said. That could keep a shop and vendor from doing business easily after the conversion date, he said.
“There could be some disruptions to workflow,” Fincher said. He urged repairers on CCC ONE to contact their vendors and ask about their plans.
Some workarounds exist for shops and vendors. A shop can always retype or copy from a PDF any of the data the vendor needs, or just send the vendor a PDF and let the vendor figure it out.
A more efficient potential workaround suggested by the task force appears to be a reality. Risley said shops will still be able to export data to Excel. “That’s not going to change,” he said.
If so, that sounds like it’d yield or be manipulated to yield the comma-separated unencrypted file the task force mentioned.
Fincher said there’s “no doubt” others are doing a good job in securing data. But it was unrealistic for shops to firewall and encrypt their own locally stored content.
CCC didn’t claim ownership of the data, Fincher said. However, he pointed out that a collision repair facility wasn’t the sole owner either — other parties had claim to elements of the repair order — and that joint ownership creates a security responsibility that someone needs to fill, Fincher said.
“We do want to have control over that data on behalf of the repair facility,” he said.
Asked why CCC wouldn’t just offer Secure Share and EMS support and let the shop pick — as Mitchell announced it’d do the next day — Fincher said the shop’s decision would affect the other data owners, and CCC had committed to protecting all customers’ data.
“We take that commitment very seriously,” Fincher said.
Asked if there had ever been a security breach in more than 20 years of EMS, Fincher acknowledged that there hadn’t been a “significant compromise” — other than the data being shared with someone a shop didn’t intend. But that’s not a reason for maintaining the status quo, he argued.
“We don’t want to be in a reactive mode,” Fincher said. He gave the scenario of an insurer or another party demanding EMS transmissions be shut down immediately and CCC trying to scramble to deliver an alternative.
Fincher said CCC processed a million EMS files today across multiple applications. “It is extremely inefficient for us,” he said.
“That was never the design or the intent of that language,” Fincher said. The intent was to be able to remove bad actors, he said, and attorneys were working to clarify provisions around cause and cure.
Fincher said the contract specifically states the vendor owns their own intellectual property, and CCC just wanted to review apps it’d never heard of. He indicated CCC wouldn’t even need to review familiar vendors.
Out of the 50 companies granted registrations so far, “most of them do compete against us,” Fincher said. To date, it’d only denied one registration from an “unrelated, outside” company which “seemed a bit fraudulent.”
CCC felt the Secure Share platform’s access to 19,000 shops (about 75 percent of which use EMS today) was an “amazing lead-generation tool” and that the “tide rises all boats.” More vendors on the platform only made Secure Share better, Fincher suggested.
Assuming one’s holdout business partners all join Secure Share by April 4, 2018, the biggest issue from a body shop’s perspective is likely the cost. $0.50 per vendor, per repair order adds up to hundreds if not thousands of dollars a year if vendors pass costs on to collision repairers.
Does the shop absorb the costs? Itemize the extra buck or two on each estimate? Raise rates a miniscule amount?
CCC wouldn’t disclose in July the number of transactions it expected to process — which would indicate how much revenue the information provider is generating.
Fincher said that CCC hasn’t raised the price of CCC ONE since it launched in 2009, and overhauling the system for Secure Share was expensive. (Managing the million EMS transmissions a year also has been expenses for CCC.) He called the $0.50 charge “fair and equitable.”
When does CCC go in to “maintenance mode” and cut the fee? Risley asked.
“We priced that in,” Fincher said. The $0.50 was necessary to meet ongoing expenses related to the service.
CCC has created an advisory board to hear concerns and feedback about Secure Share, and a vote at the CIC concluded that the task force should not be sunset but continue to work on the issue. CCC Secure Share can be emailed here, and the task force can be reached at email@example.com, firstname.lastname@example.org or email@example.com.
CIC, July 25, 2017
CIC, July 25, 2017
CIC, July 25, 2017
Left, Rick Palmer of ComputerLogic, and Dan Risley of the Automotive Service Association, right, listen to Mark Fincher of CCC during the July 25, 2017, Collision Industry Conference. (John Huetter/Repairer Driven News)
A draft of CCC’s Secure Share program for filtering and managing recipients of auto body shop data through BMS is shown in this screenshot. (Provided by CCC)
The Collision Industry Conference’s Open Industry, Data Access and Sharing Task Force showed this position statement at CIC on July 25, 2017. (John Huetter/Repairer Driven News)
QCIQ was one of the two “apps” available on CCC’s Secure Share program at its April 4, 2017, launch. (Provided by CCC)
From left, Mark Algie of 3M; Rick Palmer of ComputerLogic; and Dan Risley of the Automotive Service Association listen to Mark Fincher of CCC during the July 25, 2017, Collision Industry Conference. (John Huetter/Repairer Driven News)