Cyber Insurance for Medical Practices: Where Most Fail

In April 2026, Anne Arundel Dermatology paid $2.4 million to settle a HIPAA investigation after a breach exposed 1.9 million patient records, including patients at its Florida locations. Earlier that year, a New Jersey dermatology practice settled for a breach covering 373,630 patients. Both had cyber insurance policies. Both found out during the claims process that their coverage had gaps that left significant regulatory exposure uncovered.

That pattern shows up in claims data across healthcare. Medical practices buy cyber insurance, pay the premium each year, and assume the coverage matches their actual risk. Then a breach happens and the claims adjuster pulls the policy's technical requirements: MFA on email accounts, encrypted devices, tested incident response plan, endpoint detection on every workstation. When the practice can't show those controls were in place at the time of the loss, the insurer denies the claim or pays out a fraction of what the practice expected.

This post covers what underwriters are now requiring from medical practices, what most commonly fails the underwriting review, and how to close those gaps before your next renewal date.

Key Takeaways

• Most cyber insurers now treat MFA on email and administrative systems as a non-negotiable coverage condition, not a suggested best practice.
• Practices without a documented, tested incident response plan are either denied coverage or given exclusions that leave HIPAA breach notification costs uncovered.
• OCR regulatory fines from a breach are not automatically covered by a cyber policy; your policy needs explicit regulatory defense and penalty coverage with a sub-limit that matches your risk.
• Ransomware downtime for a 10-provider practice typically costs $175,000 to $350,000, separate from any ransom demand or regulatory fine.
• Cyber insurers are now requiring evidence of third-party vendor security reviews, not just your own internal controls.

Why Underwriting Standards Changed for Healthcare

The 2021-2024 loss cycle reset the market

Before 2021, a medical practice with basic firewalls and standard antivirus could get a reasonably priced cyber policy with minimal technical requirements. Then healthcare ransomware claims roughly doubled between 2020 and 2022, and the 2024 wave of large healthcare breaches, Change Healthcare, Ascension Health, multiple specialty practice groups, posted some of the highest loss ratios in commercial lines. Insurers that had written policies with checkbox underwriting absorbed significant losses. The market responded with stricter technical requirements, higher premiums, and narrower coverage for practices that couldn't meet the new baseline.

Florida practices draw more scrutiny from underwriters

South Florida medical practices draw more scrutiny from cyber underwriters than most markets. The combination of Medicare fraud patterns in the region (which makes them targets for credential theft and billing fraud), high patient volume relative to staff size, and a concentration of multi-location specialty groups with inconsistent IT across sites all push the risk profile higher. Practices in Miami-Dade and Broward County often run a mix of consumer-grade networking equipment and cloud-based EHR systems that were never configured for security. Underwriters know the Florida market and price accordingly.

The questionnaire is not a formality

In 2019, most cyber insurance applications were two pages. Today, the healthcare application is eight to twelve pages and includes specific technical questions about your security stack: whether you use MFA, what your endpoint protection covers, how your backups are configured, when you last tested your incident response plan. Some insurers now require an external vulnerability scan before binding. Practices that have never thought through these questions are surprised by how specific the underwriting process has gotten.

What Underwriters Require from Medical Practices Now

MFA on every administrative account

Multi-factor authentication on all email, EHR administrative, and remote access accounts went from a premium discount to a coverage condition. If you don't have it deployed across every account with access to patient data, you either get denied or receive a policy with a ransomware exclusion that guts the coverage you thought you were buying.

I've sat with practice administrators who believed they had MFA because their EHR vendor enabled it on their own portal. But the practice's Microsoft 365 accounts, billing platform logins, and remote desktop access were still running on passwords alone. That gap is exactly what attackers look for. One compromised billing department email account gives an attacker access to patient financial records, a path to file fraudulent claims, and a pivot point to other systems on the same network.

Actionable tip: Open your Microsoft 365 admin center this week and check Security > Identity > Authentication methods. If any staff accounts are not enrolled in MFA, that's the first gap to close before your renewal questionnaire arrives.

Endpoint detection and response on every workstation

Standard antivirus does not meet the current underwriting standard. Insurers specifically ask whether you have endpoint detection and response (EDR) software, which monitors workstation behavior in real time and can identify ransomware activity before it spreads across your network. A 15-seat practice with antivirus on 12 workstations and two older billing laptops running nothing will fail this check.

EDR software for a practice-sized environment runs roughly $8 to $15 per workstation per month through a managed IT provider. The premium difference between a policy that requires EDR and one with a ransomware exclusion often covers that cost within two years. It's also worth noting: EDR is one of the controls OCR looks for during a post-breach investigation, so the benefit runs in both directions.

Encrypted backups with documented restoration tests

Backup requirements have gotten stricter across the board. Most healthcare cyber policies now require:

• Backups stored off-site or in a logically separate cloud environment, not on a local drive attached to the same network
• Backup data encrypted at rest and in transit
• Restoration testing documented at least once per year, with a record of the test date and result

Practices that back up to a NAS device sitting next to their server fail this check. Ransomware that encrypts your production systems routinely finds and encrypts backup drives on the same network in the same attack. A backup that doesn't survive the attack is not a backup for insurance purposes.

A written, tested incident response plan

Underwriters ask for written incident response plans. They're not looking for a 50-page compliance document. They want to see a documented process: who gets called first, what each person does, how you notify patients, and how you satisfy the 60-day notification window required under 45 CFR Part 164 Subpart D. The plan needs to name a HIPAA counsel contact and an IT incident response lead.

The word "tested" matters. Some policies now require evidence of a tabletop exercise, a walkthrough of a simulated breach scenario, in the 12 months before renewal. A plan that was created three years ago and lives in a filing cabinet doesn't count. Review and test it annually, and document that you did. For more on what that plan needs to cover, our post on incident response planning for medical practices lays out the structure.

Actionable tip: Set a calendar reminder 90 days before your policy renewal date to run a one-hour tabletop exercise with your front desk manager, office manager, and IT contact. Walk through what each person does in the first four hours of a detected breach. Write down what you covered and file it.

Evidence of vendor security reviews

Business associate agreements are a HIPAA requirement, but cyber insurers are going further. They're asking whether you've reviewed the security posture of vendors with access to patient data: your EHR system, billing company, clearinghouse, and any cloud storage. What they want to see is evidence that you asked each vendor for a SOC 2 Type II report or equivalent, and that you have a record of what you received.

The practical implication: BAAs on file are necessary but not sufficient. If you've never asked your EHR vendor or billing company for their security documentation, you have a gap in both your compliance program and your insurance posture. Our post on vendor BAA gaps and HIPAA risk covers how to approach these reviews systematically.

Actionable tip: Email your EHR vendor and billing company this week requesting their most recent SOC 2 Type II report. If they can't provide one, document the request and their response. That paper trail shows underwriters you're actively managing third-party vendor risk.

What Happens When Coverage Falls Short

The ransom is the smallest number on the invoice

Practices that get hit with ransomware and don't have adequate coverage face costs across four separate categories. The ransom demand itself is typically $50,000 to $250,000 for a practice-sized environment. Downtime is larger: a 5-provider practice billing $800,000 annually loses roughly $30,000 per week in collections when it can't access its EHR and scheduling systems, and partial operations often cost more because staff hours spike running manual workarounds.

Forensic investigation and system restoration typically run $50,000 to $150,000 for a mid-sized practice. Patient notification letters required under HIPAA cost $2 to $6 per patient depending on whether you use mail or a notification service, plus legal review fees. For a 25,000-patient practice, that's $50,000 to $150,000 in notification costs alone before factoring in legal counsel.

OCR fines are not automatically covered

The Anne Arundel Dermatology settlement illustrates the exposure. A $2.4 million OCR settlement is a regulatory penalty. Many cyber policies include regulatory defense coverage, but they have sub-limits, meaning a $1 million policy with a $250,000 regulatory sub-limit leaves $1.75 million of that settlement uncovered. Class action litigation, which often follows large healthcare breaches, is typically covered under a separate liability provision with its own limits.

Check your declarations page for the regulatory defense sub-limit and compare it to what a breach of your patient volume would realistically cost. If the sub-limit is under 25% of your total policy limit, that's worth a conversation with your broker before renewal.

The cost of going through an OCR investigation without coverage

OCR investigations take 18 to 36 months and require significant legal work: document production, review of compliance policies, and in many cases, a corrective action plan with ongoing OCR oversight. Legal fees for a mid-sized practice working through a corrective action plan typically run $75,000 to $200,000. Without a cyber policy that includes regulatory defense coverage, that cost is entirely out of pocket.

If you want to understand what your current healthcare IT and compliance program looks like relative to what OCR expects, a structured assessment is the fastest way to find the gaps before an investigation does.

For practices that want to evaluate where they stand against both insurer requirements and OCR standards, a no-cost security and compliance assessment gives you a prioritized gap list you can take directly into your renewal conversation.

How to Prepare Before Your Renewal Date

Work backward from the application, not forward from your current setup

Get a copy of the cyber insurance application your current insurer or broker uses for healthcare accounts. It lists every control requirement. Work through each item now and document what's in place and what isn't. Most practices find three to five gaps. Two or three of those gaps, typically MFA, EDR, and backup encryption, take two to four weeks to close with the right IT support. One or two others, usually the incident response plan and vendor documentation, take longer because they require coordination across your staff and vendors.

Our managed IT services for healthcare practices include a controls baseline review that maps your environment against the underwriting checklist. Most practices complete the gap closure within 60 to 90 days.

Get your identity and access management in order first

MFA and access controls are the fastest to fix and the most frequently cited in denials. Getting MFA enforced on Microsoft 365 takes one to two hours with the right IT support. Reviewing which staff members have access to which systems, removing accounts for former employees, and documenting who holds privileged access is a day of focused work. These two items show up in nearly every denial letter and coverage dispute.

Access management also covers a HIPAA requirement that practices frequently overlook: the minimum necessary standard under 45 CFR 164.514(d), which requires limiting PHI access to what each staff role needs. If your front-desk staff can pull the same patient records as your billing team and clinical staff, that's a HIPAA gap and an underwriting gap at the same time. Our cybersecurity services include identity and access management as part of the baseline for every engagement.

Document vendor security reviews before the application arrives

Make a list of every vendor with access to your patient data. For each one, record whether you have a current BAA, whether you've requested their SOC 2 or equivalent security documentation, and when you last reviewed what they sent. That record is what your insurer is looking for when they ask about third-party risk management. If you haven't done it, start now. It takes two to three weeks to get responses from most vendors, so starting 90 days before renewal gives you time to follow up.

Actionable tip: Review your current policy's declarations page for three specific numbers: total policy limit, ransomware sub-limit, and regulatory defense sub-limit. If the ransomware sub-limit is below 50% of your total or the regulatory sub-limit is below 25%, bring those numbers to your broker before the renewal discussion starts.

Frequently Asked Questions

Does my general liability policy cover a cyber breach?

Generally, no. General liability policies cover bodily injury and property damage in the traditional sense. A cyber breach causing HIPAA penalties, patient notification costs, and business interruption falls outside general liability coverage. You need a standalone cyber policy or a cyber endorsement added to a professional liability policy, and the cyber coverage needs to specifically include healthcare regulatory defense.

What's the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses: breach response costs, forensic investigation, business interruption, and ransom payments. Third-party coverage pays for claims made against you by patients or other parties whose data was exposed. Healthcare practices need both, because a breach of patient records creates both internal recovery costs and external liability to affected patients.

If our EHR vendor gets breached, does our policy cover us?

It depends on whether your policy includes contingent business interruption and whether the vendor breach triggers coverage under the policy's trigger language. Some policies cover only breaches of systems you own. Others extend to vendor systems holding your data. Read the trigger language in your policy carefully, and ask your broker specifically whether a vendor breach affecting your patient records is a covered event.

How do I know if my current regulatory defense sub-limit is adequate?

Estimate your potential OCR exposure based on your patient volume and the types of PHI you hold. The Anne Arundel Dermatology settlement gives a reference point: $2.4 million for 1.9 million affected records. For a 20,000-patient practice, a more modest breach might draw an OCR fine in the $100,000 to $500,000 range depending on the nature of the violation and prior compliance history. Your sub-limit should cover your realistic worst-case OCR exposure, not just a nominal percentage of your total policy.

How much does cyber insurance cost for a 10-provider practice?

Premiums vary widely by the controls you have in place, your prior claims history, and your patient volume. A 10-provider practice with MFA, EDR, encrypted backups, and a documented incident response plan might pay $8,000 to $15,000 annually for $1 million in coverage. A practice with significant gaps in those controls will either pay more, get less coverage, or be denied. The cost of closing the gaps almost always costs less than the premium difference over three to five years.

Know Where You Stand Before the Renewal Letter Arrives

Cyber insurance underwriting for medical practices has shifted to technical requirements that most practices weren't built with in mind. The gap between what you think you have and what an adjuster will accept at claim time is where practices get hurt. Closing that gap takes 60 to 90 days when you start with a clear picture of where you are.

We offer a no-cost security and compliance assessment for medical practices in South Florida that maps your current controls against both cyber insurance requirements and OCR standards. You'll leave with a prioritized list you can take into your renewal conversation. Schedule one at gradientdata.com/free-assessment.