Cyber insurance for a healthcare practice — what HIPAA actually requires you to have.

The short answer

Before you compare carriers, your cyber policy needs to clear three HIPAA-specific checks. A generic cyber policy that doesn't is inadequate for healthcare:

1. HIPAA breach-notification costs covered at full policy limits, not sub-limited
2. OCR (Office for Civil Rights) investigation defense covered at full limits
3. Ransomware sublimit adequate for healthcare exposure (healthcare ransomware demands are typically materially higher than generic SMB cyber)

The carriers that consistently meet these three checks for a typical small-to-mid healthcare practice:

• Chubb — deep paper depth, longest-established HIPAA-aware cyber offering. Modal choice for practices that prioritize claims-handling track record.
• Coalition — bundled security monitoring and incident response, useful for practices without an in-house IT/security team. Modal choice for tech-forward practices.
• Beazley — strong claims-handling reputation for HIPAA breach response. Their Breach Response service is widely-referenced.
• At-Bay — insurtech alternative to Coalition.

Quote 2-3 carriers, match the three HIPAA checks, then optimize for price. Specific premium ranges vary widely — get quotes from a healthcare-aware broker.

Why healthcare cyber is different

Three things make healthcare cyber riskier than generic SMB cyber:

1. HIPAA breach notification. Under the HIPAA Breach Notification Rule, providers must notify affected individuals, the Office for Civil Rights (OCR), and sometimes media for breaches affecting 500+ patients. Notification costs are substantial — your cyber policy needs to specifically cover HIPAA-driven notification (not just generic state-AG notification).

2. OCR investigations. OCR enforces HIPAA against small practices including clinics, dental offices, behavioral health. Settlements and corrective action plans are routine; investigations can run years and require meaningful legal defense spend. Cyber policies should explicitly cover OCR investigation defense at full limits.

3. Healthcare is a top ransomware target. Per CISA and FBI IC3 reports, healthcare is consistently among the most-attacked sectors. Small practices are especially targeted because operational urgency (patient care) makes them more likely to pay quickly.

The three things to verify in any quote

1. HIPAA breach-notification cost coverage.

The right endorsement language: "Notification costs covered up to the policy aggregate, including HIPAA-specific breach notification (written notice, credit monitoring offers, call-center coverage)."

The wrong language: any sub-limit specifically applied to HIPAA notification, or coverage limited to "state-AG notification" without HIPAA reference.

2. OCR investigation defense.

The right endorsement: "Regulatory investigation defense covered up to the policy aggregate, including Office for Civil Rights investigations under HIPAA."

The wrong endorsement: regulatory investigation sub-limited at a small fraction of the policy aggregate. For healthcare, this is structurally inadequate.

3. Ransomware sublimit and OFAC compliance.

Verify the ransomware sublimit matches your practice's exposure (which depends on EHR criticality, telehealth, and patient-data volume). Also verify the policy includes OFAC compliance support for ransom payments — recent enforcement actions have penalized organizations that paid sanctioned threat actors.

What healthcare SMBs actually need

A typical practice insurance program:

• General Liability + Property — Business Owner's Policy (BOP)
• Cyber — separate policy with the three checks above
• Professional Liability (medical malpractice) — separate from cyber
• Employment Practices Liability (EPL) — for practices with employees

Don't try to consolidate cyber into a "medical practice protection package" — combined products typically have lower per-line limits and inadequate HIPAA endorsements.

What to do — in order

1. Inventory your cyber surface. EHR system, billing system, payment processing, telehealth platform, business-associate agreements (BAAs) with vendors. Your cyber policy needs to align — including third-party vendor breach exposure.
2. Quote at least 3 carriers with healthcare-specific endorsements. Coalition + Chubb + one of (Beazley, At-Bay).
3. Use a healthcare-aware broker. Brokers specializing in healthcare professional liability often carry cyber too: Marsh Healthcare, Lockton Healthcare, NSM Insurance Group (specialty wholesale), CRC Insurance Services.
4. Verify the three checks (HIPAA notification, OCR defense, ransomware sublimit) before binding. Get the endorsement language in writing.
5. Match limits to your practice size and exposure. Higher limits for practices handling behavioral health, sensitive populations, or multi-state operations.

Adjacent reading

• Best cyber insurance for a SaaS startup — same coverage, different vertical
• Best cyber insurance for a fintech startup — adjacent vertical
• Best malpractice insurance for therapists — adjacent coverage for healthcare practices