Download the printable checklist (PDF) to work through the questions with your office manager and IT contact. The checklist helps you prepare; the online supplemental is the application you submit.
1. Ask the practice manager for the business facts
- Legal business name and any DBA. Include the entities and operations you want reviewed, plus your principal address and website.
- Contact and requested terms. Have the contact’s name, email and phone, proposed effective date, requested limit and deductible available. A requested amount is not a confirmed offer.
- Operations and revenue. Describe the services you provide and enter the revenue figures and projections requested in the application. Identify any work beyond the main practice.
- Records and payment information. Estimate the records stored or processed as the question defines them. Include information held through vendors when applicable.
2. Ask your IT contact to confirm the security answers
Send your IT provider the blank supplemental or review the live questions together. The application asks about specific controls; a general statement that the practice is “secure” is not an answer to those questions.
- Where is multi-factor authentication enforced, including email and remote access?
- How are backups separated or protected, and what recovery arrangements are in place?
- Is MFA enforced for internal use of privileged accounts?
- Which answer needs a qualification, explanation or follow-up before someone signs?
Use facts you can support. Do not assume a control applies everywhere because it is enabled for one account or one system. If you are unsure, ask the person who manages it and use an available “Unknown” answer where appropriate.
3. Prepare incident and insurance history
Review the questions about past claims, incidents and circumstances. If an answer is “Yes,” gather dates, a factual explanation, remediation details and available loss information. Thrive will identify whether a market also needs loss runs, its own supplemental or other documentation.
4. Review, sign and submit
An authorized owner, officer or manager should review the complete answers and attestation, type their name and submit. You can download a completed copy after a successful submission. The current form works in one browser tab; it does not provide a shared editing link or a permanent saved draft.
Keep patient details out of the form. Describe the business, record counts and incidents without including patient names, medical records, Social Security numbers or passwords. Ask Thrive how to provide any sensitive supporting material that is actually requested.
What happens after you apply?
Thrive reviews the supplemental, identifies missing information and seeks available terms through appropriate markets or rating platforms. Market appetite and information requirements vary. Submitting an application does not bind coverage or guarantee a quote.
Preparation context: HHS healthcare cybersecurity performance goals are voluntary security guidance, not an insurance eligibility test. This checklist follows the questions in the Cyber Policy Quotes supplemental available on this site.