Cyber insurance for physician offices

Coverage

What it covers for physician offices

Helps the practice absorb what follows a compromise of its systems or its patients' records. Federal law sets the floor: the HIPAA Breach Notification Rule (45 CFR §§164.400–414) requires notifying affected individuals within 60 days of discovering a breach, alerting prominent media outlets when more than 500 residents of a state are affected, and reporting to HHS — and those duties run to small practices, not just hospital systems: federal regulators settled a ransomware investigation with a small neurology practice over a breach that may have affected 6,800 individuals. Most commercial property and general liability policies do not cover cyber risk, so it is bought as its own policy — typically paying for breach response, patient notification and credit monitoring, data restoration, and business interruption while the EHR and scheduling systems are down; some policies also address regulatory fines and penalties, though what is insurable varies by policy and state. A practice can't see patients without its EHR and schedule, and can't hold records without HIPAA's breach duties — one compromise lands on both at once.

Sources: HHS — HIPAA Breach Notification Rule (45 CFR §§164.400–414) (as of content last reviewed 2013-07-26, retrieved 2026-06-11) · HHS — OCR settles HIPAA ransomware cybersecurity investigation with neurology practice (as of 2025-04-25, retrieved 2026-06-11) · NAIC — Cybersecurity topic (as of last updated 2024-05-09, retrieved 2026-06-11)

By state

Cyber insurance by state

What physician offices need varies by state. See the full guide for physician offices in your state: Alabama · Alaska · Arkansas · California · Colorado · Connecticut · Delaware · District of Columbia · all states →