Cyber Insurance for Healthcare: Are You Compliant with Your Own Cyber Policy?

Legal fees. OCR fines. Insurance costs. Community embarrassment.

When it comes to a cybersecurity breach, the price healthcare organizations have to pay adds up, both literally and figuratively. 

That’s where cyber insurance for healthcare comes in. Insurance can help cover the steep cost of data breaches; no wonder the cyber insurance industry is forecasted to reach $20 billion by 2025.  

But cyber liability insurance providers won’t help entities unless they can prove they’re taking the necessary actions to remain compliant. 

The responsibility falls on covered entities to prove that they’re taking safeguarding protected health information (PHI) seriously. Are you taking the necessary measures to meet insurance requirements, remain compliant, and avoid the costs of a breach?  

Read on for an overview of cyber liability insurance and actions you can take now to protect your organization from potential consequences. 

Cyber Liability Insurance for Health Entities 

What is Healthcare Cyber Insurance? 

Cyber insurance helps protect healthcare organizations from the ever-growing cost of a data breach. Insurance will, partially or entirely, pay for the fines and fees that come with a data breach, ransomware attack, phishing attack, or other cybercrime. 

Those fees can include remediation costs, legal fees, paying damages to affected individuals, and more. The average cost of a healthcare breach is $10 million, the highest of any industry, and cyber insurance can help alleviate some of that significant financial blow. 

When Does Healthcare Cyber Insurance Cover You (And When Does It Not)? 

Healthcare insurance providers won’t willfully pay millions in claims without proof that the organization took appropriate measures to prevent risk. Because of that, many cyber insurance providers have stringent requirements that an entity must meet to receive a payout. 

In the case of a cyberattack, insurance will only help an organization if it can provide proof that employees complied with their own cyber policy. Entities must affirm to their provider that they have a cybersecurity framework in place before a data breach and must show that they followed it. In other words, health entities must corroborate that they abided by compliance regulations, mitigated risks, and didn’t let their policies fall through the cracks. 

3 Ways to Align With Your Own Cyber Policies 

Creating and aligning with a coherent cybersecurity policy for your organization helps mitigate risks continuously. This way, in the event of a breach, you can show your insurance provider that you took all the necessary steps to remain compliant and are more likely to receive a payout. Read on for three ways to build your Book of Evidence and stay compliant: 

1. Annual HIPAA Assessments 

Conducting periodic security risk assessments (SRA) is a hallmark of remaining HIPAA compliant. Private practices, hospitals, and health systems alike should conduct these assessments annually to identify and analyze gaps in their cybersecurity and compliance programs. Visit 4 Steps to a Successful HIPAA Security Risk Assessment to learn more about how to go through this process correctly. 

Many covered entities turn toward automated compliance software to conduct assessments that meet all the necessary criteria. Automation benefits enterprise healthcare organizations looking to leverage their risk assessments across all entities. Based on the assessment results, entities should develop a roadmap for remediating potential risks and document this process as proof to the OCR and cyber liability insurance providers. 

2. Year-Round Remediation & Compliance Management 

Although the HIPAA assessment is usually conducted annually, the best way to align with your own policies and develop a proof of effort to your provider is to remediate throughout the year based on assessment results.

There are monthly, quarterly, and yearly remediation actions you can take to empower your organization with a strong foundation of practical cybersecurity and compliance measures. These actions include: 

• Updating firmware on network devices 
• Conducting incident response testing 
• Reviewing network/system inventory 
• Test and train employees against phishing threats 
• And much more 

3. Periodic Training 

One piece of evidence that an insurance provider will look for is the strength of your organization’s training program. 22% of healthcare cybersecurity incidents are caused by insider error, so providing HIPAA training to all staff with access to sensitive data at least once a year is essential for mitigating risk and keeping employees informed of best practices. 

Training should cover everything from the basics of HIPAA to how to spot a phishing scam. Entities should document each employee’s training status and progress so that in case of a security breach, the documentation can be used as evidence to support the notion that the entity took necessary steps to try and avoid incidents. 

Conclusion 

Cybersecurity breaches seem like a non-issue to most organizations…until they happen. Fortunately, it’s not too late to protect yourself from the consequences of a cyberattack. 

If the OCR and your insurance company come calling about a recent data breach, you need to show evidence that you’ve done something within your organization to start repairing and remediating these risks (and attempted to prevent them in the first place). 

It’s important to note that cyber insurance requirements are becoming more granular, so it’s best to look carefully at the details of your particular plan. For example, does your cyber insurance require you to build a Book of Evidence? If so, and you haven’t built one, then your insurance company may decline your claim in the event of a loss of PHI. 

Clearly, complying with your insurance requirements and your cybersecurity policies is a must for healthcare systems. Solutions like HIPAA One (r) guarantee you’re doing everything possible to mitigate risk by providing step-by-step guidance to risk analysis, remediation, and documentation. By ensuring that your organization is doing whatever it can to be fully compliant, you will be prepared for whatever comes your way.   

Don’t become the next victim of a cybersecurity attack. Learn more about ensuring full HIPAA compliance by getting in touch with the HIPAA experts at Intraprise Health.