According to the U.S. Department of Health and Human Services, the number of data breaches involving the disclosure of electronic private health information (ePHI) affecting 500 or more patients in the state of Florida—the statutory threshold triggering notification obligations—increased from 19 providers in 2015 to 28 providers in 2016. Health care providers are increasingly targeted by cyberattacks because health care data are richer and more valuable for hackers, many provider employees have access to the medical data, and medical data are stored in large volumes over a long lifecycle. In light of the mounting exposures, it is essential that health care providers carefully procure cyberinsurance coverage that protects their patients and businesses.
Cyberinsurance is not a one-size-fits-all solution. Although form cyberpolicies are now readily available, reliance on forms can result in premiums for unnecessary coverages or gaps in necessary coverage. Working closely with security, privacy and legal professionals, providers should identify the mix of first- and third-party coverages that integrate with their operations to minimize risk exposures. For example, if your practice relies on digital devices (e.g., iPad), first- and third-party coverages that address the risks associated with using these devices and existing device security practices should be obtained.
First-party coverages are available to protect against various perils including data asset loss; cyberextortion/ransomware events; denial of service attacks; and business interruption. Pay attention to the breadth of key definitions such as “asset” and “interruption” in first-party coverages. Also review the definitions and exclusions to assess whether physical harms caused by cyberincidents are covered. These harms are often excluded and can fall a gap between commercial general liability, property and cybercoverages. Third-party, or liability coverage, is available for data breaches and associated costs; payment card industry data security standard (PCI DSS) assessments; defense costs and fines, including regulatory and litigation and investigatory costs. Attempt to have full policy limits available for data breach liability and response costs. Select form coverage to the extent possible, but be prepared with legal counsel to negotiate and draft manuscript endorsements to address coverage gaps or required modifications.
Breach Fines
When completing an application for cyberinsurance, it is critical that the applicant provide a candid assessment of its privacy and security practices and protocols. In Columbia Casualty v. Cottage Health System, Cottage Health was sued by a class of its prior patients whose ePHI were negligently made accessible through the internet. The class settled the underlying litigation with Cottage for $4 million dollars. Although Columbia defended Cottage and paid the settlement, it later filed a declaratory action demanding reimbursement relying in part on an exclusion named, “Failure to Follow Minimum Required Practices.”
The exclusion incorporated Cottage's application representations regarding its security practices and protocols, and excluded coverage when, “any failure of an insured to continuously implement the procedures and risk controls identified in the insured's application for this insurance and all related information submitted to the insurer in conjunction with such application whether orally or in writing …” Cottage's application representations were also memorialized in the policy as conditions precedent to coverage and warranties in favor of Columbia. Each formed the basis for Columbia's coverage defenses in the declaratory action.
Other exclusions warrant careful consideration. Exclusions for deliberate and fraudulent acts are common but should be limited so they operate only when actions are taken with approval from management personnel or after a court of law has found fraud. Breach of contractual obligations exclusions should carefully carve out breaches of certain types of agreements (i.e., confidentiality agreements; privacy policies, etc.). War and terrorism exclusions should be modified to exempt cyberterrorism.
Digital device exclusions and exclusions relating to the failure to encrypt digital devices should be analyzed by legal counsel that understands the provider's operational exposures to minimize the possibility of uncovered or excluded risks. The Department of Health and Human Services has issued numerous fines for data breaches arising out of unencrypted devices including a $3.2 million fine levied against Children's Medical Center of Dallas when the ePHI of 3,800 individuals was exposed after an employee lost an unencrypted Blackberry device. Another hospital was fined after an unencrypted laptop containing the ePHI of 2,462 individuals was stolen.
A health care provider that understands its security and privacy vulnerabilities should consult experienced insurance coverage counsel when placing cyber insurance coverage. By understanding their risks and the legal landscape, a provider can maximize the benefits of their cyber insurance premiums and avoid potentially costly gaps in coverage.
Anthony Hearn and Gabriela Pirana are associates with Ver Ploeg & Lumpkin.
Originally published on dailybusinessreview.com. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.