Having an IT provider does not, by itself, establish insurance protection for your practice. An IT agreement describes services and contractual responsibilities. A cyber policy describes specified insured losses, response services, conditions, limits and exclusions. Review each document on its own terms.
Divide the preparation work clearly
| Practice management | IT contact | Thrive |
|---|---|---|
| Business identity, operations, revenue, records and incident history. | Confirm the scope and implementation of the controls asked about. | Review the application and identify insurance follow-up. |
| Authorize the information and review the attestation. | Explain exceptions and unresolved technical questions. | Seek available terms and explain differences in proposed coverage. |
| Decide on an offered option and complete binding requirements. | Help maintain and document the actual security environment. | Coordinate insurance placement and policy questions. |
Ask specific questions about controls
“We have MFA” can leave important detail unanswered. Ask which email, remote-access and privileged accounts are protected. For backups, ask what is backed up, how copies are protected, and how recovery is tested. Use the exact application wording when confirming an answer.
HHS’s voluntary healthcare cybersecurity goals offer a useful reference for discussions with an IT provider. They are not a substitute for a practice’s risk analysis, a compliance determination or an insurer’s underwriting requirements.
Review the IT contract separately
Ask the practice’s advisers to review responsibility for incident response, notification, data recovery and vendor coordination, along with contractual liability limits. A provider’s insurance may protect the provider under its policy; do not assume it supplies the practice with its own cyber policy or pays every practice loss.
Agree on the first call after an incident
Before anything happens, identify the practice decision-maker, IT escalation contact and insurer’s incident reporting instructions. A policy may require prompt notice or consent for certain services and costs. Keep those instructions available and follow the actual policy and response plan.
For IT providers: share the application checklist with clients and help verify technical answers. Thrive handles insurance guidance; no insurance recommendation needs to be made by your help desk.
Technical preparation reference: HHS healthcare cybersecurity performance goals. This guide describes a practical division of work; the relevant contracts and policy control actual responsibilities.