“We’re trying to spread the word,” said Charlie Hodson, a sales and marketing executive with CPH & Associates in Chicago. “Our clients are starting to ask for this kind of insurance.”
Last year, CPH started offering cyber liability insurance as an add-on to client malpractice insurance after Hodson began hearing from psychologists worried about what would happen if their data were hacked and client protected health information was exposed. That includes billing information, diagnoses, test results, prescription information and visit notes.
“A lot of new products for therapists are online, like billing,” Hodson said, increasing the chance that information can get hacked. Malpractice insurance doesn’t cover a hacking incident, which is why CPH created its add-on.
The CPH cyber insurance covers security event expenses, such as reimbursement for costs associated with a breach; network security and privacy liability coverage for damages; customer notification expenses; and public relations expenses to reestablish a psychologist’s reputation or public image. The coverage includes the services of an attorney specializing in cyber crimes.
Kristina Chamis, account manager at the insurance brokerage Insureon, said cyber liability insurance, also known as data breach insurance, has been offered for about a decade but its popularity has increased in recent years because of the uptick in cyber breaches. She said rules covering what a business is required to do if data is breached vary from state to state.
“People are starting to realize it’s valuable and necessary,” Chamis said. “For psychologists, it’s in their best interest to have the coverage. Small businesses tend to think they’re not a target for these kinds of attacks, but in reality they’re more of a target because they typically have fewer protections in place than larger companies. One of our carriers says it isn’t a case of if you’ve been breached; it’s a case of when will you be breached.”
The Trust, which offers insurance to psychologists and related individuals, began offering cyber insurance this year as a separate policy for psychologists.
“We did it originally as an accommodation for a few policyholders, but because there was a need we started selling it more widely in May,” said Angela Alkire, assistant vice president of operations. “Cyber hacking is prevalent in the health care industry. If you’re a hacker it’s more cost effective to go after health care than a financial institution.”
The Trust’s cyber insurance is so new the company hasn’t done any mass marketing or added extensive information on its website, Alkire said. In part that’s because it’s still working on getting approvals from some states to offer the coverage, she said.
The Trust’s insurance covers both the psychologist and client costs if there’s a breach. That includes credit monitoring for clients, legal advice, costs for computer experts to determine how the breach happened, regulatory fines and work to reestablish a psychologist’s reputation, she said.
“If you have a patient base in a small town, your reputation could go down the tubes if there’s cyber hacking,” Alkire said.
Although The Trust had sold just two policies as of mid-May, Alkire believes the coverage will be standard in a few years
“This problem only is going to grow because it’s so lucrative,” she said. “Data from a health care provider has a long shelf life, giving the hacker the ability to conduct identity theft. You could have a very small practice and have a data breach and your ultimate cost could be the same as someone with a practice 15 times bigger.
She said the cost of a Trust cyber liability policy starts at about $600; the cost is based on the psychologist’s annual revenue and how much coverage the policy provides.
CPH has sold about 3,000 of its endorsements and has had a few claims, Hodson said. It offers two levels of coverage, one that costs $87 per year and another that costs $141 per year. The more expensive coverage has higher payout limits.
So far CPH offers its coverage in all but nine states and the company is working on adding it for customers in four of those: Colorado, Florida, New Hampshire and Virginia.
Hodson said most clients are self-employed practitioners with 10 to 20 clients a week, so an endorsement to a current policy makes more sense for them than a stand-alone policy.