Two practices, same breach: How cyber insurance changes the outcome

When a cyber attack targets an optometric practice, the technical breach is only the beginning. The recovery process is where costs, stress and long-term consequences manifest. When a breach occurs, the difference between a prolonged shutdown and a manageable recovery often comes down to preparation. 

Consider the following scenario: 

Two practices are targeted by the same cyber attack. A phishing email bypasses spam filters and a staff member from each practice accidentally downloads malware. Patient records, scheduling systems and diagnostic data are encrypted. Both practices receive a ransom demand in cryptocurrency. Practice A does not have cyber liability coverage in place, but Practice B does. 

Practice A: Managing recovery alone 

Without cyber liability insurance, the practice owner must independently assemble a breach response team. Forensic investigators, legal counsel and public relations professionals are all necessary to the recovery process, and expensive.  

Staff obligations shift from patient care to fielding questions about the breach and managing HIPAA and state law-mandated notifications. Revenue drops as downtime extends. The practice owner must make decisions about paying the ransom, delaying reopening and absorbing the losses in revenue. 

Small businesses account for 43% of cyber attacks but many lack the financial reserves to handle breach recovery and prolonged disruption. 

Practice B: Supported by cyber liability insurance 

The practice owner is an AOA member with an active cyber liability insurance policy through Lockton Affinity. She calls the breach response hotline and is connected with a team of breach response experts.  

Within hours, she receives support from: 

• A forensic team who begins investigating the breach
• IT experts who repair damaged systems
• Legal experts who advise on regulatory and notification obligations
• Public relations professionals who assist with patient communication 

Along with receiving efficient, thorough support from her team of breach response professionals, the practice owner has the peace of mind that most, if not all, of the financial costs of the breach are covered by her policy.  

Business interruption coverage helps replace lost income during downtime, and data recovery coverage helps support the restoration of encrypted patient records. Her practice is able to reopen sooner with clear guidance and reduced financial strain. 

Cyber attack response and recovery is where risk becomes reality 

Both practices faced the same cyber incident. Practice A took on the full financial and administrative burden alone. Practice B had immediate access to breach response experts and financial protection designed specifically for optometric practices. 

Cyber liability insurance can’t prevent cyber attacks, but it can facilitate a strategic and efficient recovery process. AOA members have access to cyber liability coverage tailored to optometry through AOAExcel®’s endorsed partner, Lockton Affinity. 

_{The AOA Insurance Alliance is administered by Lockton Affinity, LLC d/b/a Lockton Affinity Insurance Brokers LLC in California #0795478. Coverage is subject to actual policy terms and conditions. Policy benefits are the sole responsibility of the issuing insurance company. Coverage may be provided by an excess/surplus lines insurer which is not licensed by or subject to the supervision of the insurance department of your state of residence. Policy coverage forms and rates may not be subject to regulation by the insurance department of your state of residence. Excess/Surplus lines insurers do not generally participate in state guaranty funds and therefore insureds are not protected by such funds in the event of the insurer’s insolvency. The American Optometric Association will receive a royalty fee for the licensing of its name and trademarks as part of the insurance program offered to the extent permitted by applicable law.}