Healthcare Cyber Insurance: Who Pays When Your EHR Goes Down?
Quick answer: A healthcare cyber policy may cover income loss and extra expense after a covered technology outage, but an unavailable EHR does not automatically trigger payment. Check whether the event involves your own systems or a vendor, whether malicious and accidental outages are covered, and when the waiting period starts. Keep patient-care continuity planning separate from the insurance claim.
Which outage are you actually insuring?
An attack on a practice-owned server, a cloud EHR outage and a failed payment processor can interrupt the same appointment schedule while falling under different policy definitions. Ask the insurer to identify the provision that responds to each event. A general promise of “business interruption” is not enough to establish vendor coverage.
| Scenario to review | Question for the insurer |
|---|---|
| Your scheduling system is encrypted | Does network interruption include this system and event? |
| Your hosted EHR is unavailable | Does dependent interruption include this provider, and must it be scheduled? |
| A software update causes an outage | Is nonmalicious system failure included? |
| Staff use overtime to rebuild records | Which restoration or extra-expense terms apply, and is prior consent required? |
What should a practice collect before requesting terms?
Create a one-page dependency list: EHR, billing, imaging, prescribing, telephone and outsourced IT providers. For each, record the owner, emergency contact, backup arrangement and workaround. Ask IT to confirm controls rather than guessing on the application. Do not put patient records or credentials into a general quote form.
Then compare the waiting period, restoration period, income calculation, dependent-provider limit and any shared sublimit. Ask whether saved expenses reduce the claim and how rescheduled appointments are treated. A high headline limit can still leave a smaller vendor-outage limit.
What happens first during an incident?
Activate your clinical downtime procedure and involve the appropriate IT and clinical leaders. Use the insurer's incident contact promptly, and check consent requirements before hiring outside vendors or incurring optional recovery costs. Preserve an incident timeline, canceled appointments, overtime and recovery invoices without disrupting patient care.
HHS publishes voluntary healthcare cybersecurity goals, including incident preparedness. Those goals are a planning reference; completing them does not establish insurance coverage or certify HIPAA compliance.
What is the useful renewal test?
Walk through one realistic outage with your broker and IT provider. Ask them to point to the applicable wording, responsible vendor and first call. Resolve “we think it is covered” answers before renewal. A completed application starts underwriting; it does not bind a policy.