How is healthcare cyber risk different from general business cyber risk?
Three things make healthcare cyber materially different. (1) Regulatory exposure: HIPAA breach notification triggers at 500+ records require OCR notification within 60 days, public posting on the OCR "wall of shame," and potential investigations with fines from $100 to $50,000 per violation, capped at $1.5M per identical violation per year. (2) Data severity: protected health information (PHI) is roughly 10× more valuable on dark markets than payment card data because it's harder to remediate — you can't issue a patient a new diagnosis. (3) Patient safety stakes: ransomware that locks an EHR or imaging system isn't just a cost — it can delay diagnoses, disrupt medication orders, and force ambulance diversions. The cyber policy needs to be built around all three, not just the first.
- Category
- Business Insurance
- Audience
- Pre-purchase guidance
- Topic
- Cyber & Privacy
Related FAQs
Are owners and officers covered by their own WC policy?
It depends on entity structure. In NY, members of LLCs and partners in partnerships are not automatically covered and may elect coverage. For-profit corporation officers who are also shareholders may exclude themselves under specific conditions (Form C-105.51). Sole proprietors with no employees are exempt from carrying coverage at all but may elect to cover themselves. We walk through these elections at policy issuance — owners often want coverage for themselves because their personal health insurance excludes work-related injury.
Read answerAre wage and hour claims covered by EPLI?
Inconsistently. Most EPLI policies cover defense costs for wage and hour claims (FLSA, NY Labor Law) but exclude indemnity for the underlying wage liability — the rationale being that paying owed wages isn't a "loss," it's a debt. Some policies offer a defense-only sublimit (often $100K–$250K). NY wage and hour exposure is severe — NY Labor Law §198 allows liquidated damages plus attorneys' fees, and class actions on misclassification, off-the-clock work, and meal/rest breaks are common. Confirm wage and hour…
Read answerDo I need commercial auto insurance?
If your business owns or leases vehicles, yes — your personal auto policy almost certainly excludes business use, and a claim arising from a business-use accident on a personal policy will be denied. You also may need commercial auto if your employees regularly drive their own personal vehicles for business (in which case the right product is **hired and non-owned auto** — HNOA — which can be added to a BOP or general liability policy). Healthcare practices that do home…
Read answerDo I need WC if I only have 1099 contractors?
Often, yes. NY (and most states) applies a substance-over-form test — if a worker functions like an employee (you set hours, supervise the work, provide equipment, pay regularly), they're an employee for WC purposes regardless of how their tax form is labeled. NY's WCB has been particularly aggressive on misclassification audits in healthcare, construction, and home-services industries. If you genuinely use independent contractors, get certificates of insurance from each one showing they carry their own WC coverage; if they don't,…
Read answerDoes commercial property cover floods or earthquakes?
Almost never — both are standard exclusions in commercial property policies. Flood requires a separate NFIP policy or a private flood policy; earthquake requires either an endorsement (where available) or a standalone policy. NY is not in a high earthquake risk zone, but flood is genuinely material — much of NYC, Long Island, and the Hudson Valley sits in mapped FEMA flood zones, and a single flooded basement can run $100K+ in property and inventory losses. If your premises are…
Read answer
STILL HAVE QUESTIONS?
We answer the same business day.
If yours isn't covered here, schedule a consultation and we'll get you a clear answer.