For medical and dental practices
Cyber insurance for medical and dental practices
The short answer
Healthcare practices answer the standard cyber insurance questions with HIPAA sitting on top of them. Carriers weight backups and incident response hardest, because a practice that can't access records can't see patients. Much of what the application asks for, including a documented risk analysis and written policies, is what the HIPAA Security Rule already requires.
What's different about medical and dental practices
Downtime is clinical, not administrative. A practice whose records are encrypted on a Monday morning isn't inconvenienced, it's closed, and rescheduling a week of patients costs more than the ransom demand usually does. That's why the backup and restore-test questions carry so much weight on a healthcare application.
Staffing makes response harder than the plan admits. In a practice, the person who knows the systems is often also the person seeing patients, and the front desk cannot pause to investigate a ransom note. That is why the plan matters more than the tooling: someone has to be named in advance, with the authority to send patients home and the phone number for the carrier's incident hotline already written down.
Your data is also the most expensive kind to lose. Protected health information carries notification duties with federal timelines, and the reporting obligation doesn't wait for your recovery to finish. Underwriters ask about the incident response plan because the first 48 hours determine the size of the claim.
There's one problem almost unique to clinical settings: the machine you can't patch. Imaging equipment, lab analyzers and practice hardware often run an operating system the manufacturer froze years ago, and replacing the computer means replacing a device that costs more than a car. Applications ask about unsupported systems by name, and an undisclosed one is the kind of detail that surfaces badly after a claim.
The overlap with HIPAA works in your favor. If you've done the Security Rule work properly, you have a risk analysis, written policies and workforce training records, which is most of the documentation a carrier wants. If you haven't, the application is about to tell you, and so would an auditor.
What already applies to you, before any insurer asks
These aren't insurance requirements. They're obligations that exist whether you buy a policy or not, and the paperwork they call for is most of what an application wants to see.
HIPAA Security Rule
If you create, receive, maintain or transmit protected health information, the Security Rule requires a documented risk analysis, written policies and procedures, workforce training, and safeguards appropriate to your size. The rule is currently the subject of federal rulemaking, so expect the specifics to tighten rather than loosen.
Breach notification
Losing protected health information triggers notification duties with defined timelines, and larger incidents bring additional reporting. A written plan is what makes those deadlines survivable, because the clock does not pause while you work out which systems held what.
Business associate agreements
Anyone who handles patient data on your behalf needs an agreement in place, and that list is longer than most practices expect: the records vendor, the billing company, the transcription service, the IT provider with remote access. Carriers ask about third-party risk, and this is the paperwork that answers it.
General information, not legal advice. Whether a rule applies to your business turns on facts we don't know about it, so confirm with your own advisor.
The questions carriers weight hardest here
Every application covers the same ten control areas. All of them are written out here. These are the ones an underwriter reads twice for medical and dental practices.
When did you last successfully test restoring from a backup?
Why it's weighted here: A practice that can't restore its records can't treat patients, so carriers ask when you last proved a restore works.
If the answer is no: Run a restore test this month: restore a folder and one full system, time it, and document the result. That document answers the application question.
Your written evidence: Backup & Recovery Policy §5 Restore testing
How is your critical business data backed up?
Why it's weighted here: Ransomware deletes reachable backups first, and an offline or immutable copy is what keeps a practice from paying.
If the answer is no: Stand up automatic off-site backup for critical systems this week, then schedule a restore test.
Your written evidence: Backup & Recovery Policy §3 How we back up (the 3-2-1 rule)
Do you have a written incident response plan?
Why it's weighted here: Protected health information carries notification deadlines that start before your systems are back.
If the answer is no: Write the one-page version today (who to call, how to isolate, where backups are), then grow it into a full plan with the template.
Your written evidence: Incident Response Plan (Fill-in-the-Blank) §2 Roles + Incident Response Plan (Fill-in-the-Blank) §4 The first 24 hours
How often do employees receive security awareness training?
Why it's weighted here: Workforce training is a HIPAA requirement and an application question, so the same dated record answers both.
If the answer is no: Start simple: a 30-minute session this month using ready-made materials, an attendance sheet, and a calendar reminder for next quarter.
Your written evidence: Security Awareness Training Policy §4 Documentation (the part underwriters ask about)
Evidence to have ready
- Your most recent HIPAA risk analysis, dated, with the remediation decisions it produced
- Workforce training records with dates and attendance
- Business associate agreements for anyone who touches patient data, and the vendor inventory that tracks them
- The date of your last restore test, and how long the restore took
The written half of that list is what the Readiness Pack is: Backup & Recovery Policy, Incident Response Plan (Fill-in-the-Blank), Data Protection & Classification Policy, Vendor & Third-Party Risk Policy, each personalized to your business and mapped to the question it answers.
Common questions
Our electronic health record system is cloud-hosted. Are backups their job?+
Partly, and you still have to answer for it. Ask your vendor in writing what they back up, how long they retain it, how fast they can restore you, and whether a copy is immutable. Then keep that email. On the application, the question is whether your critical data is backed up and tested, and pointing at a vendor without evidence is not an answer.
Does HIPAA compliance mean we'll pass the cyber application?+
It gets you most of the way, because the documentation overlaps heavily. The gaps tend to be technical controls carriers now name specifically: endpoint detection and response, enforced multi-factor authentication on remote access, and a restore test recent enough to be credible.
Our imaging machine runs an old version of Windows. Does that sink the application?+
Not by itself, and hiding it is far worse than disclosing it. Put the device on the end-of-life register with the compensating controls around it: network segment, no internet access, no email on that machine, and the replacement or vendor-upgrade date. Underwriters price a known, isolated legacy device every day. What they cannot price is finding it during a claim investigation.
We're a two-dentist practice. Is any of this proportionate?+
The controls scale down, the questions don't. Enforced MFA, a tested backup, a written one-page incident plan and a documented training session are all achievable in a week for a small practice, and they're what stands between a bad Monday and a closed office.
Sources
- HIPAA Security Rule (update in rulemaking)
- CISA Cyber Essentials and small-business hub
- Coalition Cyber Claims Report 2026 (ransomware recovery)
- CIS Critical Security Controls v8.1, Implementation Group 1
See where your practice stands, free
Sixteen questions, five minutes, a score across the ten control areas underwriters probe, and your three biggest gaps with the fix for each. No email needed for the score.