When a clinic's systems go dark, patients still arrive. Staff fall back to paper, appointments slip, and health records sit out of reach until the systems return.
Cyber insurance for healthcare can pay for much of the response and the lost income. Underwriters look hard at clinics, though. Here is what they look for and what you can prepare.
Why insurers look closely at healthcare providers
Health data is some of the most sensitive data a business can hold. Under the GDPR in Europe and the UK GDPR, health data is special category data and needs extra protection. A breach can bring notification costs, regulator questions and claims from patients.
Clinics also depend on a small number of systems. A practice management system runs bookings, records and billing. An imaging server stores scans. When either stops, care slows and the pressure to pay a ransom rises. Attackers know this.
For example, a dental clinic with two sites shares one imaging server and one cloud booking system. An underwriter will want to know how the clinic would keep treating patients if both went down on a Monday morning.
The cyber risks underwriters see in healthcare
- Ransomware on core systems. The practice management system or imaging server gets encrypted, and appointments stop.
- Data theft and extortion. Criminals copy patient records and threaten to publish them unless the clinic pays.
- Supplier outages. A cloud booking or records provider goes down, and every clinic that uses it goes down too.
- Older devices. A workstation attached to an X-ray or scanning machine still runs software the vendor no longer supports.
- Email fraud. A fake equipment supplier sends an invoice with new bank details.
What underwriters usually ask healthcare businesses
- How many personal records do you hold, and do you hold health data? A data inventory or record of processing gives the number.
- Is MFA enforced for all users, including remote access and third parties? Include your software vendor's support access. A console export proves it.
- Do you run paid endpoint protection on every device? Count reception PCs and the workstations next to clinical machines. A licence or console screenshot answers it.
- Do you apply critical and high patches within one month, and do you run any end-of-life software? An asset inventory and a patch report answer both. If an old system must stay, show how you have separated it from the rest of the network.
- Do you keep backups offline or in a purpose-built cloud service, with a restore test in the last six months? A dated test record is the evidence.
- Do you have a breach notification procedure and a named privacy lead? Some countries require a data protection officer for health data. Your adviser can confirm.
- Which hosted providers do you rely on? List them, and check whether your contracts give you a written outage report.
Cover that matters most for healthcare
- Privacy breach management costs. Notifying patients, credit and identity monitoring, and a call centre. Some wordings need the insurer's consent before you send notices, so call them first.
- Privacy liability and regulatory costs. Claims from patients, legal help with the regulator, and fines where the law allows insurance of them.
- Cyber extortion. Many policies pay a ransom only with the insurer's prior written agreement. Some carry a separate ransomware sublimit or coinsurance, so check the amount.
- Business interruption and extra costs. Lost income after the waiting period, plus overtime and temporary workarounds to keep seeing patients.
- Dependent business interruption. Income lost when your cloud provider has an outage. Some wordings need a written root cause report from that provider.
- Contingent bodily injury. A few wordings cover injury caused by a cyber event where no other policy responds. Your medical malpractice cover stays separate.
How PrismX helps healthcare businesses get insurance ready
- Discover maps your clinic: sites, systems, patient data, suppliers such as the practice software vendor, and the people who must hear first about an incident.
- Assess checks each control and shows how your answers read on the insurer's questions.
- Improve turns each gap into an action with an owner and a date, for example replacing an unsupported imaging workstation.
- Verify stores the evidence in the vault, where each document gets an AI check and advisor verification. Expiry stays visible: a restore test counts for six months.
- Submission pack: PrismX builds a signed pack with a sha256 fingerprint, so the insurer reviews exactly what you signed.
- During an incident: in the pilot, PrismX follows the notification clocks in your wording, such as a 48-hour or 72-hour window.