cyber insurance

By Shawna Bertalot, CIC, ACI, WisMed Assure President

Many health care practices rely on a third party for access to their EMR and for billing. This creates a “contingent” or “dependent” risk. The February 21 cyberattack on Change Healthcare changed the world for many patients and health care providers. The March 14 and March 28 issues of Medigram included resource links and information on potential payment programs for Part A and Part B providers impacted. For practices and organizations that contracted with Change Healthcare™ to facilitate the electronic transfer of medical documentation and billing for all their insurance claims, revenue stopped, expenses continued and funding programs from Optum and CMS/Medicare have not been comprehensive solutions.

Cyber Insurance programs can provide additional coverage for a scenario like this, but only if the policy includes Business Income or Business Interruption coverage and includes Contingent Business Interruption or Dependent Business Interruption coverage. Without contingent or dependent coverage, your policy would only respond if the cyberattack were on your organization and would not respond if the attack were against a third party upon whom you are dependent. We discussed the importance of comprehensive cyber insurance in the November 2, 2023 issue of Medigram and the Fall 2023 issue of The Antidote.

Important Considerations for Cyber Insurance Coverage:

• Cyber insurance policies do not always include contingent or dependent coverage.
• Cyber coverage included as an add-on to other policies, like a business owners’ package or medical professional liability, typically do not include this coverage.
• Business Interruption or Business Income options are not automatically covered.
• Paying claims for cyber policies is complicated and typically requires forensic information technology and legal review to confirm the breach or attack. This can take weeks or months before any payment will be made.
• Policyholders must provide proof of loss and that the incident in question directly resulted in the policyholder’s loss of income, without regard to whether an event has been widely reported in the news.
• Deductibles and waiting periods will apply.
• Reach out to the insurance carrier as soon as you become aware of an incident, before you hire your own consultants, and respond promptly and completely to their requests for supporting documentation. Your insurer will have specialized relationships at pre-negotiated rates.

If you are concerned about your Contingent or Dependent Risk and wondering if your current cyber insurance policy has coverage, how that coverage works or if you can obtain coverage, contact your WisMed Assure agent or shawna.bertalot@wismedasure.org.

Note: This article is for informational purposes only and should not be considered as insurance advice related to your specific policy or situation. Please consult with a qualified insurance advisor or professional before making any policy decisions. Full disclaimer and contact information.

By Shawna Bertalot, CIC, ACI, WisMed Assure President

Message from IT Manager: “Unusual activity has been detected on your exchange and our files cannot be backed up.”

This is not how any clinic administrator or managing partner wants to start their Monday morning, but exactly what happened to a long-time WisMed Assure client last December. This highly experienced, professional administrator of a 15-physician independent clinic with over 50,000 patient records was facing a situation she had never experienced before.

“These things always seem to happen over the weekend,” she noted as she recounted how she first learned about a hacker that had made repeated attempts using several different employee sign in credentials to access the clinic’s system. The Wisconsin Department of Justice contacted the clinic’s IT Manager regarding suspicious activity.

Her first questions were, “What exactly is happening? What access or information have they gained? And how do we stop them?”

Her first call was to an outside IT vendor the clinic had used in the past. She was immersed in trouble shooting the immediate issues and it wasn’t until about a week later that she remembered that they have Cyber Liability Insurance and called WisMed Assure.

“In hindsight, that should have been first call, and it is in our policies and procedures now,” she said.

The cyber insurance carrier was extremely responsive. Most policies say that the insurance carrier will select the IT, Legal and other vendors because they have pre-approved and negotiated rates to save everyone time and money. The carrier made an exception and approved the IT vendor the clinic had first contacted so the investigation could proceed.

It took approximately 10 days to identify exactly what was happening, confirm patient and clinic data was secure and develop a plan to stop the attacks. That plan involved removing and restoring Microsoft Exchange, blocking access, using temporary email addresses and ultimately completely rebuilding the clinic’s network. Fortunately, no personal health or personal financial information was breached. The insurance carrier also hired legal counsel to review the forensic IT reports and confirm that no notifications were necessary.

Fortunately for this clinic the hacking attempts were caught and stopped before there was any access to confidential data or impact to patient care. It’s not hard to imagine the stress, worry and disruption this caused the clinic administrator, partners and staff. The IT forensic and legal consulting fees were very costly. The bulk of the investigation and restoration expenses were covered by the insurance policy. The clinic decided to assume some costs to move to cloud-based hosting and implement some additional measures to upgrade their security.

The clinic manager concluded “we learned a lot about what to do and not to do when something like this happens again,” and she believes, “It’s not a matter of if, but when.” She was very appreciative they had robust cyber insurance with a carrier that was responsive and successful in stopping a hacker that could have caused a lot more damage.

If you want more information about cyber threats and insurance coverage, contact your WisMed Assure agent or shawna.bertalot@wismedasure.org.

Note: This article is for informational purposes only and should not be considered as insurance advice related to your specific policy or situation. Please consult with a qualified insurance advisor or professional before making any policy decisions. Full disclaimer and contact information.