Cyber Liability & HIPAA

In most cases, no. General liability excludes cyber incidents, explicitly or because the wording was never designed for them. Cyber liability is a separate, necessary coverage.

Not by law today. But HIPAA expects covered entities to be able to respond to a breach, and cyber insurance is the most practical way to have those resources. Some managed care contracts are starting to require it.

Any vendor that handles your patients' protected health information for you, such as scheduling software, billing services or your EHR. A breach on their systems can still create notification obligations for your agency.

A breach is unauthorized access to or disclosure of protected information. Ransomware encrypts your systems and demands payment to unlock them. A cyber policy covers both, but they trigger different response costs.

HIPAA allows up to 60 days from discovery. Several states where we operate require notice within 30 to 45 days, and the shortest applicable deadline governs.

A lost or stolen device with unencrypted patient information is a potential HIPAA breach that triggers notification duties. If the device was encrypted, it generally isn't a reportable breach. This is one of the most common breach scenarios in home health.

Yes. Ransomware groups target small healthcare businesses because their security is thinner and they're more likely to pay to get critical systems back. Being small doesn't reduce your HIPAA obligations or notification costs; it reduces your ability to absorb them.