HIPAA Cyber Insurance for Technology

The Role of Business Associate Agreements (BAAs)

A BAA is the legal instrument that binds your company to HIPAA's requirements. It specifies how you will protect PHI, what you must do if a breach occurs, and the indemnification obligations you accept. Most BAAs require the business associate to maintain specific insurance coverage, including cyber liability and professional liability, with minimum limits that often start at $1 million per occurrence.

The contract language matters enormously. A BAA that requires you to indemnify the covered entity for all regulatory fines, breach notification costs, and third-party claims creates a financial exposure that your insurance must address at the policy-form level. If your policy excludes regulatory proceedings or caps breach response at a sublimit of $100,000, the gap between your contractual promise and your actual coverage is where the loss lands.

Navigating the HIPAA Security Rule Safeguards

The Security Rule organizes its requirements into three categories: administrative, physical, and technical safeguards. Each category creates duties that, if breached, can trigger both regulatory penalties and civil claims. The proposed rule changes would require encryption of ePHI at rest and in transit, eliminate the distinction between "required" and "addressable" implementation specifications, and mandate written security policies reviewed at least annually.

For technology companies, the technical safeguards carry the most direct relevance: access controls, audit controls, integrity controls, and transmission security. A failure in any of these areas can serve as the factual basis for a negligence claim by your customer, an OCR enforcement action, or both. Your cyber policy's regulatory defense coverage and your tech E&O policy's wrongful act definition need to align with these specific duties.

Comparison of Coverage: General Liability vs. Tech E&O

General liability policies contain broad exclusions for professional services and electronic data. A CGL policy will not respond to a claim that your SaaS platform failed to encrypt PHI or that your managed IT service introduced a vulnerability into a hospital's network. The tech E&O form is where that coverage lives, and the specific wording of the "wrongful act" definition determines whether a HIPAA-related service failure triggers the insuring agreement.

Why Professional Liability is Required for Customer Contracts

Healthcare organizations increasingly require their technology vendors to carry both cyber liability and technology E&O with specified minimum limits. This is not a suggestion: it is a condition of doing business. The requirement flows directly from the risk that a vendor's error or omission could expose the covered entity to breach notification obligations, OCR penalties, and class action litigation.

Your customer's risk manager will typically ask for a certificate of insurance naming the covered entity as an additional insured on the tech E&O policy. If your policy form does not support additional insured status or if the coverage grant excludes HIPAA-regulated data, you will not satisfy the contract requirement. Bloc Cyber's approach to this problem is reading the actual policy form at the insuring-agreement level before binding, so you know whether the coverage grant matches what your BAA requires.

A standard cyber policy written for a retail or professional services firm may define "personal information" in a way that excludes PHI or limits regulatory coverage to state breach-notification statutes without addressing HIPAA. The difference between a standard form and one structured for HIPAA exposure often comes down to three or four endorsements and a handful of definition changes. Those details determine whether the policy responds to the claim or generates a reservation-of-rights letter.

Common Indemnification Clauses in Tech Agreements

Most technology vendor agreements with healthcare organizations include a mutual indemnification clause, but the obligations are rarely symmetrical. You will typically be required to indemnify the customer for losses arising from your breach of the BAA, your failure to comply with applicable law (including HIPAA), and any unauthorized access to PHI caused by your systems or personnel.

The indemnification obligation often includes the customer's costs of breach notification, regulatory defense, and settlements with affected individuals. If your cyber policy has a $50,000 sublimit for regulatory proceedings and the OCR investigation costs $400,000, the remaining $350,000 is your company's direct financial responsibility. This is the kind of gap that a form-level policy review identifies before you sign the contract.

Minimum Coverage Limits for SaaS and IT Vendors

Contract requirements vary by customer size and the volume of PHI involved, but common minimum limits include:

• Cyber liability: $1 million per occurrence / $2 million aggregate
• Technology E&O: $1 million per claim / $2 million aggregate
• General liability: $1 million per occurrence / $2 million aggregate
• Umbrella or excess: $5 million (increasingly common for enterprise healthcare contracts)

Some large health systems now require $5 million in cyber liability as a floor. The cyber insurance market has grown substantially in response to this demand, and carriers have developed endorsements specifically for technology companies handling regulated health data.

FAQ: How much does a typical cyber policy cost for a small business?

Does my general liability policy cover a HIPAA data breach? No. General liability policies exclude electronic data and professional services. You need a standalone cyber liability policy with PHI coverage and a tech E&O policy for service-related claims.

Can one policy cover both cyber liability and technology E&O? Yes. Many carriers offer blended forms that combine both coverages. The key is confirming that each insuring agreement is written with adequate limits and that HIPAA-specific endorsements are included.

What happens if I do not carry the insurance limits my BAA requires? You are in breach of the BAA. The covered entity may terminate the agreement, and you lose the contractual defense that your insurance would have provided in a claim.

Are HIPAA fines insurable? In most U.S. jurisdictions, civil monetary penalties imposed by OCR are insurable. Criminal penalties are not. Your policy form must explicitly include regulatory fines and penalties within the coverage grant.

How does the Change Healthcare breach affect my coverage requirements? The 2024 Change Healthcare incident, which exposed data belonging to roughly 100 million individuals, prompted healthcare organizations to increase minimum insurance requirements for all technology vendors in their supply chain. Expect higher limits and more detailed coverage verification.

Do I need separate policies for each healthcare customer? No. A single cyber liability and tech E&O program covers your operations across all customers. Each customer can be added as an additional insured or certificate holder as needed.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.