Texas imposes its own medical privacy statute, HB 300, which in several respects is stricter than federal HIPAA requirements. HB 300 applies to a broader category of entities, including non-covered entities that handle health data, and it mandates notification to the Texas Attorney General within 60 days of discovering a breach affecting 250 or more individuals. Penalties under HB 300 can reach $250,000 per violation.

Federal HIPAA enforcement through the Office for Civil Rights adds a second layer. A single breach event can trigger parallel investigations at both levels. Your cyber policy form needs to respond to both: regulatory defense costs for OCR proceedings and separate coverage for state AG actions. Not every policy form treats these as the same insuring agreement, and some impose sublimits on one or both. The Texas Medical Records Privacy Act creates obligations that go beyond standard HIPAA compliance, which means your coverage must be structured with Texas-specific exposure in mind.

When a PHI breach occurs, Texas law and federal HIPAA both require written notification to affected individuals. For a practice with 10,000 patient records, notification costs alone, including printing, mailing, call center setup, and credit monitoring services, can exceed $500,000. Forensic investigation to determine the scope of the breach typically runs $200,000 to $400,000 depending on network complexity.

A well-structured policy form covers these as first-party breach response costs. The critical details sit in the sublimits and retentions. Some forms cap forensic costs at $100,000 or impose a separate retention for notification expenses. At Bloc Cyber, the review process involves reading the actual insuring agreements and endorsements before binding, so you know exactly where the coverage grant stops and where a gap begins. That form-level review matters far more than the aggregate limit printed on the declarations page.

OCR investigations are expensive to defend even when no fine is ultimately assessed. Legal fees for responding to a HIPAA investigation routinely reach $250,000 to $750,000. If the investigation results in a resolution agreement or civil monetary penalty, the amounts can be substantially higher.

Your policy form may respond to regulatory defense costs and, in some cases, to the fines themselves, depending on how the insuring agreement is written and whether Texas law permits insurance coverage for the specific penalty. Not all forms cover state-level fines under HB 300 without an endorsement. This is exactly the type of gap that a policy-specific review identifies before a claim forces the issue.

Business interruption coverage in a cyber policy typically includes a waiting period, often 8 to 12 hours, before the coverage begins to respond. After the waiting period expires, the policy pays for lost net income based on your historical financial performance. For a mid-size Texas practice generating $3 million in annual revenue, a three-week EHR outage could represent $175,000 or more in lost income.

The waiting period and the measurement period both deserve scrutiny. Some policy forms use a 24-hour waiting period, which means the first full day of lost revenue falls on you. Others define "restoration" narrowly, so coverage ends when systems are technically functional even if you have not yet cleared your claims backlog.

When EHR systems go down, your staff does not stop working. They switch to paper charting, manual scheduling, and phone-based communication with pharmacies and labs. These workarounds require temporary staff, overtime, and sometimes physical supplies you would not otherwise purchase.

Extra expense coverage pays for these costs above your normal operating expenses. A practice that normally employs two front-desk staff may need four during a manual recovery period. The policy form should cover the incremental difference. Some forms bundle extra expense into the business interruption insuring agreement; others break it out with a separate sublimit. Knowing which structure your form uses determines whether you have adequate protection.

MFA is no longer optional for healthcare cyber insurance. Underwriters check for MFA on email, remote access, and privileged accounts before they will quote a policy. Practices that rely on single-factor authentication for any of these access points will face declinations or exclusionary endorsements.

The requirement extends beyond simple email MFA. Underwriters want to see MFA on your EHR platform, your practice management system, and any cloud-based service that stores PHI. If your IT environment cannot support MFA on a specific legacy system, you need to document compensating controls and be prepared to accept a higher retention on that exposure. A specialist agency like Bloc Cyber can identify which underwriters will accept compensating controls and which will not, saving you time in the submission process.

Your aggregate limit should reflect the number of patient records you hold, your annual revenue, and your regulatory exposure. A common starting framework: multiply your active patient record count by $200 to $300 to estimate breach response costs, then add your projected lost revenue for a 30-day EHR outage. For a practice with 25,000 active records and $4 million in annual revenue, that calculation produces a minimum limit in the $2 million to $3 million range.

Sublimits matter as much as the aggregate. A $3 million aggregate policy with a $500,000 sublimit on regulatory defense may leave you significantly underinsured if OCR and the Texas AG both open investigations. Being HIPAA-compliant does not automatically make your practice insurable at adequate limits; underwriters evaluate operational security independently of compliance status.

Does my cyber policy cover fines from the Texas Attorney General under HB 300? Some policy forms cover insurable fines and penalties, but coverage depends on the specific endorsement language and whether Texas law permits indemnification for that category of penalty. Review the regulatory proceedings insuring agreement before binding.

How long does the waiting period last before business interruption coverage kicks in? Most healthcare cyber forms impose an 8- to 12-hour waiting period, though some use 24 hours. The waiting period starts when the system failure begins, not when you report the claim.

Can I add cyber coverage to my existing malpractice or BOP policy? Endorsements on package policies typically offer narrow coverage with low sublimits. A standalone cyber form provides broader insuring agreements and higher limits appropriate for PHI exposure.

What happens if a breach affects patients in multiple states? You must comply with the breach notification law in each affected patient's state of residence. Your policy form should cover multi-state notification costs without geographic limitations. Texas providers with patients across state lines need coverage that reflects multi-state regulatory obligations.

Do I need cyber insurance if my EHR vendor is cloud-based? Yes. Your vendor's liability coverage protects the vendor, not your practice. You remain responsible for breach notification, regulatory defense, and lost revenue during an outage caused by a vendor incident.