Questions to ask when reviewing your cyber liability insurance

Cyber liability insurance policies can look similar at first glance, but the details determine whether coverage truly supports your optometric practice when a cyber attack occurs. For practices that rely on interconnected clinical systems, patient data and third-party vendors, reviewing cyber coverage requires careful attention. Before renewing your policy or selecting new coverage, asking the right questions can help ensure your coverage reflects the real risks facing optometric practices. 

Ask your insurance broker these critical questions when reviewing your cyber liability insurance options. 

1) Does my policy cover both first-party and third-party losses? 

A cyber incident can affect more than just internal systems. Practices may face direct losses, such as data recovery costs and business interruption, as well as third-party claims from patients, vendors and payment processors. Ask whether your policy includes: 

• First-party coverage for data recovery, cyber extortion, and business interruption
• Third-party liability coverage for patient data exposure, regulatory actions, and vendor-related claims 

Some policies limit coverage to one category, leaving practices exposed to significant uncovered expenses. 

2) What happens immediately after a breach? Who do I call? 

Response time and efficiency are crucial following a cyber incident to prevent increased downtime, regulatory risk, or reputational harm. Some policies only provide reimbursement for expenses after the fact, leaving practice owners to track down independent breach response vendors on their own. When reviewing cyber liability insurance coverage, practice owners should ask: 

• Is there a dedicated breach response hotline?
• Does the policy provide access to forensic investigators, IT remediation experts, legal counsel, and public relations professionals?
• Are the vendors pre-approved, or do I need insurer consent before engaging them?
• Are these services included in the policy limits or treated as optional add-ons? 

Coordinated access to breach response professionals through a single point of contact is key to reducing confusion and potential delays during high-stress incidents. 

3) Is business interruption coverage triggered by both breaches and system failures? 

For optometric practices, downtime can halt diagnostics, billing and patient flow entirely. Unfortunately, not all business interruption coverage is adequate to cover the potential losses following a breach. Ask your broker: 

• Does coverage apply only to security breaches in which data is stolen, or also to system failures?
• Is income loss covered if a third-party vendor outage prevents scheduling, billing or claims submission? 

Some policies include dependent business interruption coverage, which applies when vendor outages impact your practice’s operations. This type of coverage is critical for practices relying on multiple integrated platforms. 

4) Are HIPAA fines, penalties and regulatory defense costs covered? 

Cyber attacks involving protected health information (PHI) often trigger HIPAA notification requirements and regulatory scrutiny. Legal guidance and compliance support can be expensive. Ask these key questions: 

• Does my policy cover regulatory defense costs?
• Are HIPAA fines and penalties included, and are they subject to sublimits?
• Does coverage extend to state privacy law obligations? 

Robust cyber liability insurance coverage includes regulatory defense and penalty coverage that may be lacking in base policies or policies that aren’t designed for health care providers. 

5) Does my policy address ransomware and cyber extortion realistically? 

Ransomware is one of the most disruptive cyber threats facing health care practices. Even when the ransom is not paid, the associated investigation, system restoration and downtime can be significant. Ask whether: 

• Cyber extortion costs are covered
• Legal guidance is provided prior to responding to ransom demands
• Coverage applies to cryptocurrency-related incidents, such as cryptojacking 

Policies tailored to the needs of optometric practices include defined cyber extortion coverage and access to experienced advisors to guide response decisions. 

6) Are specialized risks like payment card fraud and funds transfer fraud included? 

Optometric practices routinely process patient payments and interact with financial institutions. Cyber incidents involving payment systems can trigger contractual penalties and unrecoverable losses. Ask your broker: 

• Does my policy include payment card liability coverage?
• Is funds transfer fraud or fraudulent instruction covered?
• Are telephone and social engineering fraud included? 

These coverages can be excluded from standard small-business cyber liability insurance policies but are important considerations for optometric practices. 

7) Are my coverage limits and sublimits transparent and adequate for the size of my practice? 

Last but not least, review your limits carefully. Find out: 

• Are breach response services subject to sublimits?
• Is the aggregate limit sufficient if multiple response costs arise from a single incident?
• How many individuals can be notified under the policy without triggering out-of-pocket expenses? 

Look for cyber liability coverage options with clearly defined limits, breach response allowances, and enhancement tiers designed for independent practices. 

Choosing cyber liability insurance is about more than just checking a box. It’s about ensuring that your coverage aligns with how your practice actually operates. Asking the right questions can reveal whether your policy will truly support recovery if your practice is breached and patient trust is on the line. 

AOA members can explore cyber liability insurance coverage options designed with the needs of optometric practices in mind through AOAExcel®’s endorsed partner, Lockton Affinity. 

^{The AOA Insurance Alliance is administered by Lockton Affinity, LLC d/b/a Lockton Affinity Insurance Brokers LLC in California #0795478. Coverage is subject to actual policy terms and conditions. Policy benefits are the sole responsibility of the issuing insurance company. Coverage may be provided by an excess/surplus lines insurer which is not licensed by or subject to the supervision of the insurance department of your state of residence. Policy coverage forms and rates may not be subject to regulation by the insurance department of your state of residence. Excess/Surplus lines insurers do not generally participate in state guaranty funds and therefore insureds are not protected by such funds in the event of the insurer’s insolvency. The American Optometric Association will receive a royalty fee for the licensing of its name and trademarks as part of the insurance program offered to the extent permitted by applicable law.}