Cybersecurity matters for healthcare organizations now more than ever. Over the past 18 months, healthcare organizations have increasingly become the target of cyber criminals. Healthcare is also a highly regulated industry and organizations need to carefully protect sensitive patient data, also referred to as protected health information (PHI).
Coalition’s Comprehensive coverage bundles include first-party coverage options that can help healthcare organizations mitigate cyber risks. For example, our third-party Bodily Injury and Property Damage coverage can help with the costs resulting from medical equipment failure during a cyber attack, while our Breach Response coverage pays for costs involved with responding to a cybersecurity incident, including incident response, customer notification, legal fees, and legal advice in connection with the incident.
Patient data exposed with one wrong click
Attackers are increasingly assaulting hospitals that provide critical patient care. During the September surge of COVID-19 infections, the ransomware group Vice Society attacked multiple U.S. hospitals and leaked patient info via a data leak site when victims chose not to pay their extortion demands. As reported in the Wall Street Journal, U.S. Department of Health and Human Services data showed monthly data breaches of healthcare organizations impacted nearly 1 million people with each leak.
Coalition has also seen a rise in cyber incidents targeting healthcare organizations. Specifically, Coalition claims data shows that the claims frequency increased 2% in 2020 and 2.2% percent in 2021. In 2020, Coalition’s average claim severity for healthcare organizations was $185k.
Ransomware attacks hold the potential to be especially devastating for healthcare organizations as the downtime these businesses experience during attacks have widespread impact across the entire business, most importantly, potentially impacting patient care.
To better understand this, let’s take a look at the experience of one Coalition healthcare policyholder that had been operating for 30 years. One morning, this policyholder turned on their computers to find all of their files encrypted, including their backups, making restoration impossible. As a policyholder, this company immediately contacted Coalition. Coalition Incident Response (CIR) quickly determined this healthcare company had fallen victim to HelloKitty, a devastating new ransomware that makes business data inaccessible and bombards the victim with calls and requests to pay. Without backups, the policyholder had no choice but to pay the ransom. However, CIR negotiated a lower ransom payment, reducing the ransom demand down by nearly 75% from $750,000 to $200,000. Coalition covered the costs to respond to the incident, recover lost data, and pay the attacker in order to get their data released.
However, cyber extortion is not the only money at risk when an organization becomes victim to a ransomware event. When an organization is not operating, its business grinds to a halt, patients can’t be seen, routine billing ceases and there is no revenue generation.
The events of the last year demonstrate that healthcare organizations cannot neglect cybersecurity basics. Ransomware is not the only attack vector threatening these organizations. Attacks using compromised email accounts can lead to ransomware or funds transfer fraud (FTF) events. Further, data breaches resulting from a cyber attack can potentially lead to regulatory action and fines against the victim organization under the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is the most notable privacy law; it provides a set of standards to protect data from being disclosed without a patient's consent or knowledge.
Bodily injury and regulatory coverage
Healthcare facilities must face the unfortunate reality that a cybersecurity incident could impact patient care. For example, a cyber attack on an organization’s computer system can lead to operational downtime or the inability to use medical equipment, which can impact patient care. With Coalition’s coverage for bodily injury or damage/impairment to your tangible property, your organization can mitigate these losses. These coverages are part of our Comprehensive package and are sub-limited. The typical sub-limit is $250K, but higher sub-limits are available on a risk-by-risk basis.
Tip: All policyholders should immediately toll-free +1 833 866 1337 or email firstname.lastname@example.org as soon as you think your business has been the subject of a cyber attack or incident. The sooner, the better.
Also, because healthcare organizations deal with sensitive patient and insurance data, they are subject to various privacy regulations, including HIPAA. If your healthcare organization is the victim of a cyber attack, Coalition’s insurance coverage can cover expenses incurred to defend any claims resulting from third parties or regulatory fines and penalties assessed due to a data leak. Once we receive notification that a policyholder has experienced an incident, our claims team, which includes privacy and data breach attorneys, springs into action to help begin the recovery process.
Protect your business: get insured
Coalition offers comprehensive coverage for the cyber risk exposures facing a multitude of businesses today. Cyber insurance is a key factor in addressing and mitigating cyber risk. It can help minimize your organization’s exposure and quickly facilitate remediation if your business is the target of a cyber incident. If you have questions about our claims process or want to be connected to a broker, feel free to reach out to our team. If you’re a broker interested in offering Coalition cyber insurance to your clients, click here to get appointed.
Additionally, Coalition offers a wealth of resources to help businesses implement good cybersecurity practices. Coalition’s cybersecurity guide outlines the basic tenets of a cybersecurity program — a critical factor in reducing your organization’s cyber risk.