A vendor outage is not automatically a covered cyber insurance loss. Some policies offer dependent business interruption or related protection, but the wording determines which providers and events qualify. The service being unavailable, on its own, is not enough to establish coverage.
List the services the practice depends on
Start with your EHR, practice-management software, scheduling, cloud hosting, clearinghouse, billing and payment services. For each, record what would stop, what could continue manually, what extra costs you might incur, and how long you could reasonably operate that way.
Ask these questions when comparing quotes
- Which providers qualify? Is the relevant EHR, billing or other provider within the policy’s definition? Are particular providers excluded or subject to separate treatment?
- What event must occur? Does the wording respond to a security incident, a system failure, both, or another specifically defined event?
- When does protection begin? What waiting period, deductible or retention applies?
- Which losses are measured? How are income loss and extra expense defined, documented and calculated?
- What is the recovery window? Review the period of restoration or indemnity, and any maximum duration.
- What limits apply? Check sublimits, exclusions and any aggregate shared with other coverages.
Distinguish a supplier outage from a customer outage
A practice losing access to a vendor is different from a business losing revenue because its customer has a cyber incident. Some products address these dependencies differently. Describe the actual relationship instead of relying only on a coverage label.
A useful explanation for Thrive: “We use this provider for this part of our operation. If it were unavailable, this work would stop and these workarounds would cost money.” Provide business-level details without patient information.
Use the application to open the discussion
Complete the supplemental accurately and keep your vendor dependency notes available for follow-up. The initial application may not capture every dependency. Thrive can use the additional context when reviewing available terms and identifying market-specific questions.
Examples of differing coverage concepts: CFC’s healthcare cyber overview and CFC’s customer business interruption explanation. These sources describe product concepts, not a coverage determination for your practice.