Dental offices combine patient care with scheduling, imaging, payments and claims processing. When the technology behind those activities is disrupted, the practice may face both response costs and an interruption to normal work. Cyber insurance should be discussed alongside the office’s actual systems and recovery arrangements.
Start with the office workflow
- Appointments and patient records: identify where practice-management software and records are hosted.
- Imaging and connected equipment: identify which systems depend on the office network or outside software.
- Payments and claims: note processors, clearinghouses and billing arrangements, plus how changes to payment instructions are verified.
- Remote access and support: identify who can connect to the network and who confirms MFA and backup answers.
Discuss the costs an incident could create
Review incident response, privacy liability, cyber extortion, data restoration and business interruption with Thrive. Ask how the proposed policy treats extra expenses used to keep the office operating, any waiting period before interruption coverage applies, and the limits or sublimits attached to particular losses.
If the practice could be tricked into sending money through a fraudulent payment instruction, discuss the relevant cybercrime or social-engineering wording separately. Coverage, conditions and available limits can differ from the main cyber limit.
A cloud system still deserves a question
Outsourcing a system changes who manages it; it does not answer every insurance question. Identify the practice-management, imaging, cloud, payment and billing services that matter most. Ask whether interruption at those providers could qualify under the proposed wording. The vendor-outage guide provides a short comparison checklist.
Let the right person answer each part
Your office manager can gather business details, revenue and incident history. Your IT provider can help confirm technical controls. An authorized representative reviews and signs the completed supplemental. The site does not require a separate ACORD form to start this application; a selected market may still need additional information.
Describe the actual business. If several entities, locations or practice owners are involved, identify them clearly and ask Thrive how they should be presented. A website name and a legal insured name are not always the same.
Prepare before opening the form
Use the healthcare cyber application checklist to gather what you need. Keep patient names, charts and other patient-level information out of the supplemental. Submit business descriptions and aggregate estimates requested by the questions.
Preparation and exposure sources: HHS healthcare cybersecurity goals and CFC’s healthcare cyber overview. Actual coverage and acceptance depend on underwriting and the policy issued.