[{"innerBlocks":[],"name":"core\/freeform","postId":127681,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"

8 steps to ensure you have adequate cyber insurance<\/h2>
Many healthcare organizations have data theft coverage, but policies rarely offer blanket protection and many have other coverage limits, warns Collin Hite, a security and data privacy expert at the Hirschler Fleischer law firm. Here\u2019s what HIT executives can do to make sure they\u2019re safe.<\/p>

Everyone at risk<\/h2>
Cyber attacks are hitting provider organizations of all sizes and small practices are not exempt, Hite says. These practices could be easy prey because they don\u2019t have sophisticated IT security in place and can\u2019t afford to fight off an attack, and they typically don\u2019t have redundant backup systems. Consequently, small practices need to look into cyber insurance, as should all providers, he notes.<\/p>

Due Diligence<\/h2>
When purchasing coverage, be proactive to ensure you are getting the coverage you expect. Work with a broker who really knows the field, because the security environment and subsequent insurance market are changing so rapidly, says Hite, who also suggests procuring the services of a cyber insurance coverage attorney to negotiate with the broker on the policy.<\/p>

Coverage holes<\/h2>
Cyber coverage, however, comes with limits, and not all of those limits are clear. Language in insurance policies commonly includes \u201csublimits,\u201d which \u201ccan really play a game of \u2018gotcha\u2019 in the coverage,\u201d he explains. Sublimits are caps on what the insurer will pay for certain services covered under cyber insurance. For example, payments for public relations services following a breach may be capped at $100,000, and if the breach is sizable, that won\u2019t be enough.<\/p>

Credit monitoring<\/h2>
Some types of cyber insurance may include sublimits on credit monitoring services. If the sublimit is $200,000 and the services cost $225,000, the provider is on the hook for $25,000. \u201cWork with your broker and underwriter to assess your needs and costs, but it\u2019s a best estimate, not a perfect science,\u201d Hite advises.<\/p>

Big Bucks<\/h2>
Breaches are prohibitively expensive; costs are everywhere. There is the cost to re-secure and rebuild a network, get legal help, conduct forensic investigations, do the PR work that includes breach notification, protective services for affected patients, extortion coverage and other liabilities. Providers may not be buying insurance that covers all of these issues, Hite warns.<\/p>

Liability Costs<\/h2>
Provider organizations also may consider buying third party coverage to address liability claims from affected individuals. To date, most victims have not been able to demonstrate proof of harm, but if they can in future incidents, addressing those claims will cost money.<\/p>

Definitions<\/h2>
Even after providers assess whether they are buying enough coverage and can financially handle additional costs once sublimits are reached, providers must look closely at the definitions contained in the policies. \u201cThe real issue in cyber coverage is definitions of certain terms, which could exclude coverage,\u201d Hite says.Coverage goes into effect on the day it was bought, but in instances where a hacker already has infiltrated information systems before a policy was purchased, there may be no coverage because policies often don\u2019t work retroactively. Hite advises buying a \u201cretroactive date\u201d policy that covers the organization back at least one year.<\/p>

Provider Homework<\/h2>
Organizations with the financial and technical means should have a strong response team in place with everyone knowing what their duties are if an attack comes. Smaller providers, however, are more reliant on external help. But there is homework they can do now to be better prepared later on.Insurers will give providers a list of available law firms for which they will pay. Pick a firm and start a relationship with the firm immediately, regardless of your organizational size, Hite counsels. This way, \u201cyou\u2019re not figuring out things on the fly about getting forensics, a law firm and credit monitoring,\u201d he says. \u201cThis is a risk management and brand management issue.\u201d<\/p>

","saveContent":"

8 steps to ensure you have adequate cyber insurance<\/h2>
Many healthcare organizations have data theft coverage, but policies rarely offer blanket protection and many have other coverage limits, warns Collin Hite, a security and data privacy expert at the Hirschler Fleischer law firm. Here\u2019s what HIT executives can do to make sure they\u2019re safe.<\/p>

Everyone at risk<\/h2>
Cyber attacks are hitting provider organizations of all sizes and small practices are not exempt, Hite says. These practices could be easy prey because they don\u2019t have sophisticated IT security in place and can\u2019t afford to fight off an attack, and they typically don\u2019t have redundant backup systems. Consequently, small practices need to look into cyber insurance, as should all providers, he notes.<\/p>

Due Diligence<\/h2>
When purchasing coverage, be proactive to ensure you are getting the coverage you expect. Work with a broker who really knows the field, because the security environment and subsequent insurance market are changing so rapidly, says Hite, who also suggests procuring the services of a cyber insurance coverage attorney to negotiate with the broker on the policy.<\/p>

Coverage holes<\/h2>
Cyber coverage, however, comes with limits, and not all of those limits are clear. Language in insurance policies commonly includes \u201csublimits,\u201d which \u201ccan really play a game of \u2018gotcha\u2019 in the coverage,\u201d he explains. Sublimits are caps on what the insurer will pay for certain services covered under cyber insurance. For example, payments for public relations services following a breach may be capped at $100,000, and if the breach is sizable, that won\u2019t be enough.<\/p>

Credit monitoring<\/h2>
Some types of cyber insurance may include sublimits on credit monitoring services. If the sublimit is $200,000 and the services cost $225,000, the provider is on the hook for $25,000. \u201cWork with your broker and underwriter to assess your needs and costs, but it\u2019s a best estimate, not a perfect science,\u201d Hite advises.<\/p>

Big Bucks<\/h2>
Breaches are prohibitively expensive; costs are everywhere. There is the cost to re-secure and rebuild a network, get legal help, conduct forensic investigations, do the PR work that includes breach notification, protective services for affected patients, extortion coverage and other liabilities. Providers may not be buying insurance that covers all of these issues, Hite warns.<\/p>

Liability Costs<\/h2>
Provider organizations also may consider buying third party coverage to address liability claims from affected individuals. To date, most victims have not been able to demonstrate proof of harm, but if they can in future incidents, addressing those claims will cost money.<\/p>

Definitions<\/h2>
Even after providers assess whether they are buying enough coverage and can financially handle additional costs once sublimits are reached, providers must look closely at the definitions contained in the policies. \u201cThe real issue in cyber coverage is definitions of certain terms, which could exclude coverage,\u201d Hite says.Coverage goes into effect on the day it was bought, but in instances where a hacker already has infiltrated information systems before a policy was purchased, there may be no coverage because policies often don\u2019t work retroactively. Hite advises buying a \u201cretroactive date\u201d policy that covers the organization back at least one year.<\/p>

Provider Homework<\/h2>
Organizations with the financial and technical means should have a strong response team in place with everyone knowing what their duties are if an attack comes. Smaller providers, however, are more reliant on external help. But there is homework they can do now to be better prepared later on.Insurers will give providers a list of available law firms for which they will pay. Pick a firm and start a relationship with the firm immediately, regardless of your organizational size, Hite counsels. This way, \u201cyou\u2019re not figuring out things on the fly about getting forensics, a law firm and credit monitoring,\u201d he says. \u201cThis is a risk management and brand management issue.\u201d<\/p>

","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Liability Costs<\/h2>Provider organizations also may consider buying third party coverage to address liability claims from affected individuals. To date, most victims have not been able to demonstrate proof of harm, but if they can in future incidents, addressing those claims will cost money.<\/p>

Liability Costs<\/h2>Provider organizations also may consider buying third party coverage to address liability claims from affected individuals. To date, most victims have not been able to demonstrate proof of harm, but if they can in future incidents, addressing those claims will cost money.<\/p>

Liability Costs<\/h2>
Provider organizations also may consider buying third party coverage to address liability claims from affected individuals. To date, most victims have not been able to demonstrate proof of harm, but if they can in future incidents, addressing those claims will cost money.<\/p>

Liability Costs<\/h2>
Provider organizations also may consider buying third party coverage to address liability claims from affected individuals. To date, most victims have not been able to demonstrate proof of harm, but if they can in future incidents, addressing those claims will cost money.<\/p>

8 steps to ensure you have adequate cyber insurance

More for you