Healthcare practices hold exactly what attackers want: identity data, insurance numbers and clinical records, inside systems that have to stay up for patient care. A ransomware event at a clinic is both a data breach and an operational outage, and it can start at a vendor you have never thought about. This guide explains the notification rules that follow a breach, the controls insurers now expect, what cyber insurance typically covers for a practice, and the gaps we see most often.
Why practices are exposed
The 2024 ransomware attack on Change Healthcare showed how a single vendor incident can reach almost every corner of healthcare. HHS reports that Change Healthcare told its Office for Civil Rights (OCR) that approximately 192.7 million individuals were affected. HHS also made a point that matters for every practice: covered entities remain ultimately responsible for breach notification, even though they may delegate the notice work to the vendor that was breached. Your patients' data does not have to be stolen from your office for the problem to be yours.
Smaller practices face the same threats as health systems, usually with fewer IT resources: phishing that leads to email compromise, ransomware delivered through remote access tools, lost or stolen devices, misdirected records and fraudulent payment instructions. Our ransomware defense and business email compromise guides go deeper on the attack patterns.
What a breach triggers
Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of protected health information (PHI) is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI was compromised. The assessment considers four factors: the nature and extent of the PHI involved, the unauthorized person who used or received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated.
| Who must be notified | When (HIPAA) |
|---|---|
| Affected individuals | Without unreasonable delay and no later than 60 days after discovery |
| Prominent media serving a state or jurisdiction | When more than 500 residents of that state or jurisdiction are affected; same 60-day limit |
| HHS (500 or more individuals) | Without unreasonable delay and no later than 60 days after the breach |
| HHS (fewer than 500 individuals) | Annually, no later than 60 days after the end of the calendar year in which the breach was discovered |
| The covered entity, by its business associate | Without unreasonable delay and no later than 60 days after the business associate discovers the breach |
Washington's breach law runs on a shorter clock. Washington residents must be notified in the most expedient time possible and no more than 30 days after the breach is discovered, and breaches affecting more than 500 Washington residents must also be reported to the Attorney General within the same window. Washington's definition of personal information includes medical information and health insurance policy or identification numbers. Which laws apply, and how they interact, is a question for breach counsel, which is one reason a cyber policy's panel counsel is valuable. Our data breach notification guide covers notice content and methods.
The clock starts at discovery. HIPAA and Washington timelines run from when the breach is discovered, not from when the investigation finishes. Report to your cyber carrier immediately so forensics and counsel can start the same day.
The HIPAA Security Rule: where it stands
HHS published a proposed overhaul of the HIPAA Security Rule in the Federal Register on January 6, 2025, with more prescriptive expectations for safeguards such as encryption and multi-factor authentication. As of mid-2026, the rulemaking had been moved from the final rule stage to long-term actions, with the federal regulatory agenda pointing to final action no earlier than July 2027. The current Security Rule remains in force, including its requirements for risk analysis and risk management. Waiting for a final rule is not a security strategy; insurers are already underwriting to many of the proposed controls. See our HIPAA compliance essentials for the current framework.
Controls underwriters ask about
Cyber applications have become detailed security questionnaires. Answers affect eligibility, price and, in some policies, whether a claim is paid. These are the controls we see asked about most often:
- Multi-factor authentication on email, remote access, the EHR and administrator accounts. See our MFA guide.
- Backups that ransomware cannot reach, kept offline or immutable, with restores tested on a schedule.
- Endpoint detection and response on workstations and servers, monitored by someone.
- Timely patching, especially of internet-facing systems and remote access tools.
- Phishing and security awareness training with documented completion.
- Business associate agreements and vendor review for billing companies, IT providers and cloud vendors. Our vendor security assessment guide has a starting checklist.
- Wire and payment verification procedures that require a call-back before changing bank details.
- A written incident response plan that names who calls the carrier, counsel and IT.
What cyber insurance typically covers
Cyber policies are not standardized. Coverage grants, sublimits and exclusions differ significantly by carrier, so the table below describes common components, not a promise of coverage.
| Coverage part | What it typically pays for |
|---|---|
| Incident response | Breach counsel, forensic investigation, notification, call center and credit or identity monitoring |
| Data restoration | Recovering or recreating data and systems damaged in an attack |
| Business interruption | Lost income and extra expense while your own systems are down |
| Dependent business interruption | Income loss when a vendor's system outage stops your operations, often sublimited |
| Cyber extortion | Negotiation support and, where lawful and insurable, ransom payments |
| Privacy liability | Defense and damages when patients or others sue over a breach |
| Regulatory proceedings | Defense of regulatory investigations and, where insurable by law, fines and penalties |
| Social engineering and funds transfer fraud | Money lost to fraudulent payment instructions, usually sublimited and sometimes conditioned on verification procedures |
Gaps we see most often
- Relying on a malpractice policy's cyber endorsement. Many professional liability programs include a small privacy sublimit. It may help with a lost laptop; it is rarely enough for a ransomware event with weeks of downtime.
- Thin dependent business interruption. If your EHR, clearinghouse or billing vendor goes down, the coverage that responds is dependent business interruption, and its limit may be a fraction of the policy limit.
- Application answers that no longer match reality. If the application says MFA is everywhere and it is not, the carrier may contest the claim. Re-check answers at every renewal.
- Using your own IT vendor before calling the carrier. Many policies require use of approved vendors or prior consent; costs incurred outside the panel may not be reimbursed.
- Retroactive dates and prior acts. Intrusions often start months before discovery. A change in carriers without continuity can leave the earlier period uncovered.
When to call a broker
Call us before your renewal application is due, when you change EHR, billing or IT vendors, when you add locations or telehealth services, and immediately after any suspected incident, after you notify the carrier's hotline. As a broker, we compare cyber forms across the market and help you match limits and sublimits to your actual downtime and notification exposure. Learn more on our cyber liability insurance page, and keep our incident response planning guide with your plan.
This article is general information, not legal advice. Breach notification decisions should be made with qualified breach counsel.
Sources
- U.S. Department of Health and Human Services — Breach Notification Rule
- U.S. Department of Health and Human Services — Change Healthcare cybersecurity incident FAQs
- Washington State Office of the Attorney General — Washington's data breach notification laws
- Paubox — HHS pushes final HIPAA Security Rule update to 2027 (July 2026)