Denied Coverage After a Breach? Failing to Meet HIPAA Standards Could Be Why

Many healthcare practices assume they’re covered under cyber insurance—until they aren’t. Here’s why HIPAA compliance could make or break your claim.

Cyber insurance has become essential for healthcare practices in the age of ransomware and data breaches. Failure to take appropriate security measures, including those required by HIPAA, can increase the likelihood that a cyber insurance carrier will deny coverage, depending on the circumstances of the breach. Learn how this can affect your practice and what steps you can take to reduce this risk.

Why Cyber Insurance Matters

Healthcare practices are high-value targets for cyber criminals because of the sensitive nature of protected health information (PHI). In 2023, the Office of Civil Rights (OCR) of the Department of Health and Human Services reported a 239% increase in large hacking-related data breaches and a 278% increase in ransomware attacks for healthcare practices within the preceding four years.

While larger organizations with multiple locations are often the primary targets, small healthcare practices are not immune. Cyber insurance can help cover financial losses and liabilities when these attacks occur, assuming the claim is approved.

What’s at Stake if a Cyber Insurance Claim is Denied?

For HIPAA-covered entities, a security incident can lead to significant damage. Your practice could face long-term harm to patient relationships and professional reputation. You may receive negative media attention, especially if OCR conducts an investigation into your security measures and HIPAA compliance.

If your claim is denied, you may be left to absorb costs that could include:

• OCR penalties for HIPAA violations
• Professional fees for help investigating the breach and addressing security gaps
• Lost revenue due to operational disruption
• Legal fees from patient lawsuits
• Public relations or marketing support to rebuild trust

Cyber insurance is meant to reduce that fallout, but only if you meet the policy’s requirements.

Why HIPAA Compliance Affects Cyber Insurance

Healthcare practices that are HIPAA compliant demonstrate a baseline level of security, which reduces risk for insurers. Thus, cyber insurance policies often include requirements that align with HIPAA’s standards. If your practice fails to meet those standards, you may be in breach of your policy’s conditions. In that case, the insurer could deny your claim on the grounds that your noncompliance contributed to the breach or violated your contractual obligations.

Common pitfalls include:

• Not encrypting PHI in electronic communications
• Lacking a formal incident response or breach notification plan
• Failing to implement physical and technical safeguards
• Ignoring previously identified vulnerabilities
• Skipping annual risk assessments or staff training

Each lapse in compliance can affect your ability to access coverage.

What can you do to satisfy HIPAA requirements?

To be HIPAA compliant, you should appoint a compliance officer, such as yourself, to oversee these efforts. You must develop policies and procedures that address how your practice will store, access, use, and disclose PHI. Include physical safeguards (i.e., what your practice will do to ensure physical records are secure) and technical safeguards (i.e., what your practice will do to ensure electronic records are secure). Update your policies and procedures if a change in the circumstances calls for a security update. 

You should also create an incident response plan and a breach notification plan in the event of a security incident. Conduct regular risk assessments—at least annually—and periodic audits to evaluate how effectively your HIPAA policies and procedures are being implemented. Make sure you sign business associate agreements with any of your vendors or other third parties with access to your patients’ PHI and reassess their HIPAA compliance regularly. If you have staff, provide them with ongoing training so they remain current with their responsibilities and evolving cybersecurity best practices. 

See our related video, “Business Associate Agreements (BAAs) in Healthcare”.