Medibank's 2022 cyber incident made it Australia's case study in institutional trust repair: years of remediation, litigation and security investment later, the trust rebuild is won or lost in ordinary service moments — claims resolved instantly, policy questions answered accurately, data handled visibly carefully; an agentic frontline with audit-grade governance turns every conversation into evidence that Medibank has changed.
Medibank is Australia's largest private health insurer, serving roughly four million customers across the Medibank and ahm brands, ASX-listed with a growing Medibank Health division.
Public factThe 2022 cyberattack — one of Australia's most consequential data breaches — led to regulatory action, class-action litigation and a multi-year, publicly reported security-uplift and remediation program.
Public factPrivate health insurance participation economics make retention decisive: premium-rate-rise season triggers annual switching waves amid cost-of-living pressure.
Public factClaims and benefit-limit questions dominate routine volume; extras claims (dental, optical, physio) are high-frequency, low-complexity and automatable.
Reasoned inferencePost-incident, customers are more sensitive to how their health data is handled in every channel — a governance-first service architecture is a differentiator, not a checkbox.
Reasoned inferenceRate-rise announcement periods likely create predictable contact and churn spikes that fixed staffing absorbs badly.
Seller hypothesis — validateValidate with the account team before outreach: Post-incident vendor-security requirements and onboarding timeline · Claims-status and extras contact volumes by queue · Rate-rise-period churn cohorts and current retention-outreach coverage · Existing CCaaS/chatbot estate and containment rates
Limited internal ability or appetite to build the core platform — strong candidate for the packaged solution
Evidence: Medibank is an insurer whose technology investment is committed to security uplift, core modernization and its health-services expansion — not platform engineering; post-incident risk appetite favors mature, security-vetted vendor platforms with audit-grade governance over any internal AI build.
Why they won't build the full stack: Building conversational AI in-house would put an unproven system at the center of health-data conversations while the company is still demonstrating remediation to regulators, courts and customers; a governed platform with strict data boundaries and human gates is the only architecture consistent with the security posture Medibank now publicly stands on.
Medibank's 2022 cyber incident triggered a multi-year, publicly reported remediation and security-investment program, with regulatory proceedings and class actions keeping data handling under sustained public scrutiny.
GTM implication: Lead every conversation with governance: audit-grade logging and strict data boundaries make the agentic frontline part of the trust-rebuild evidence, not a new risk surface.
FY25 results commentary emphasized continued policyholder growth, digital-health investment and customer retention momentum entering FY26.
GTM implication: Frame retention outreach and claims-service quality as protecting the growth momentum management is publicly reporting — measurable at rate-rise season.
| Workflow | Why it matters here | Value | Complexity | Speed | Channels |
|---|---|---|---|---|---|
Claims status and extras-claims service In-conversation claims status, limits and gap answers; the highest-volume queue shrinks to genuine exceptions. | Claims are the product experience of health insurance; status and benefit-limit questions are the dominant queue. Friction today: Members call to check claim status, remaining limits and gap estimates — answers that live across claims and policy systems. | App chatVoiceWeb | |||
Rate-rise retention and plan-review outreach Every at-risk member gets a plan-review conversation with policy-bounded options; save rate measured by cohort. | Annual premium increases are the churn event of the category; most switchers leave without a single retention conversation. Friction today: Retention outreach is capacity-limited to a fraction of at-risk members during the exact weeks everyone shops. | VoiceSMSApp chat | |||
Policy servicing and cover-change desk Accurate cover changes executed in-conversation with waiting-period rules applied consistently. | Life-stage cover changes (families, extras levels, hospital tiers) are revenue-relevant service moments handled inconsistently at volume. Friction today: Cover comparisons and change processing require human walkthroughs; waiting-period rules confuse members into calls. | VoiceApp chatWeb |
Voice & channel orchestration, telephony, conversational execution, session/state, routing, integration build. Capability coverage validated during implementation.
API access to these systems is the critical-path dependency.
Identity-bound sessions, policy-bounded actions, 100% audit logging, human approvals at defined points, in-tenant intelligence.
All figures are modelling estimates from the labeled inputs above — nothing here is customer-provided yet. The pilot's first job is replacing these assumptions with Medibank's measured baseline. Package price covers implementation only; recurring usage billed separately.
Why this package for Medibank: Claims service plus retention outreach plus policy servicing are natural multi-workflow Scale scope, with the governance depth the post-incident vendor-security bar demands.
Packages cover implementation and integration only. Recurring costs are billed separately: Tilicho Labs platform usage (~$0.15/call-min indicative, usage only), Google Cloud consumption, telephony/carrier charges, managed operations, and support & optimization. No package includes unlimited usage.
“The trust rebuild is measured in service moments, not statements; instant, accurate, visibly careful conversations are the daily proof of a changed Medibank — and the retention lever that protects the customer base the incident put at risk.”
“Post-incident, every new system must strengthen the security story: a governed platform with strict data boundaries, full audit trails and human gates fits the architecture standard your uplift program established.”
“Rate-rise season sets your staffing peak at Australia's most expensive service labor; elastic agentic capacity absorbs the annual spike and the claims-status baseline without carrying either year-round.”
“Most switchers leave without a retention conversation; population-scale plan-review outreach with approved options is the highest-leverage churn number you can move this year.”
“Health data demands the strictest posture in the portfolio: Australian residency options, minimum-necessary data access, 100% interaction logging and human gates on clinical-adjacent questions — governance built for the scrutiny you operate under.”
“Claims-status automation plus measured retention lift pays back against Australia's highest cost-per-contact; the pilot quantifies both against your own baseline with usage-based run cost.”
Written from this account's own research — the strategic signal, the capability gap, the entry workflow, and the modelled economics — not a mail-merge template. Pick the moment and the persona, edit anything, then copy or open in your mail client.
Customer-safe by construction: drafts are composed only from customer-facing fields. Account tier, build-vs-buy classification, priority score, internal routing, and partner-commercial detail are not inputs to the composer, so they cannot appear in a draft. Money figures are always framed as modelled from the customer's own volumes. Read before sending — you own what goes out.
Australia's largest private health insurer is still consolidating trust after its landmark 2022 cyber incident — claims, retention and policy servicing for ~4 million customers where every interaction now carries a trust premium, at Australia's highest service-labor costs.
Governance-first briefing with security and customer leadership: present the health-data handling architecture, then scope a Scale pilot on claims-status service ahead of the next rate-rise season.
Entry: Claims status and extras-claims service · Scale package · 10–14 weeks to production across priority workflows. Human fallback throughout; success thresholds agreed before build.
Start the pursuitResearch-based priority-account universe assembled from public information, market scale, communication volume, and solution fit. This is NOT an authoritative list of top Google Cloud customers; existing Google Cloud relationships are noted only where publicly reported. Validate every account with the account team before outreach.