Healthcare Cyber Insurance: When Two Insurers Ask the Same HIPAA Question

Healthcare organizations carry more than one insurance policy for good reason. Cyber liability responds to a data breach, and professional liability responds to a claim about patient care. For years, the renewal paperwork for each had little in common.

But now, the applications have begun to overlap. The security questions on a cyber policy have grown longer and more detailed. A number of professional liability carriers have started asking questions of their own about how patient data is secured, and a finance leader reviewing both renewals in the same year may notice the same wording appearing twice.

That raises a question worth pausing on: if one security gap can surface on two applications at once, how much is riding on how you answer a single one of them?

Have you assessed your security posture recently? You may be surprised what you find: The Security Gap Many Businesses Don’t Know They Have

The Questions Appearing on Both Applications

Cyber insurance underwriting has tightened considerably over the past several years. The application once accepted a signature as proof; now, carriers ask applicants to confirm that specific controls are running, and many verify those answers before issuing a quote.

The controls healthcare applicants are asked about tend to include:

• Multi-factor authentication on any system that touches electronic protected health information
• Endpoint detection and response across workstations and servers
• Encrypted backups that have been tested for recovery
• Identity and access management that limits who can reach patient data
• A written incident response plan with named roles
• A current HIPAA Security Risk Analysis

Read that list again. Very little of it is specific to insurance. Each item describes a safeguard a healthcare organization is expected to have in place, regardless of its coverage.

Each carrier phrases these questions in its own way. What they are checking is consistent; an underwriter wants evidence that the organization can keep patient data protected and available, and that it can recover when something goes wrong.

Why Professional Liability Carriers Ask About Cybersecurity

Professional liability coverage was built around clinical care. It responds when a patient alleges that a diagnosis or a treatment caused harm. For most of its history, data security sat outside that scope.

The line has started to move. More professional liability carriers now include cybersecurity questions on renewal applications.

The reason is practical: when ransomware takes an electronic health record system offline, the effect reaches patient care. Appointments get delayed, and clinicians can lose access to patient histories and medication records. Care decisions then get made with incomplete information.

A disruption like that can lead to a claim about the standard of care, which is the territory a professional liability policy already covers. Some carriers also note that cyber interruptions have produced bodily injury claims in healthcare settings, which gives them reason to ask about the controls that would prevent such an interruption.

For the organization completing the forms, the result is clear: a question about MFA or access controls can now appear on a professional liability renewal for reasons that have nothing to do with a traditional malpractice claim.

One Rule Underneath Both Reviews

Both sets of questions share a source. The safeguards a cyber underwriter asks about, and the ones a professional liability carrier has started to ask about, trace back to the HIPAA Security Rule.

The current HIPAA Security Rule already requires covered entities and their business associates to run a risk analysis and to put safeguards in place for electronic protected health information. Those safeguards govern how patient data is accessed and protected, and how the organization recovers when systems go down. It’s the same ground an insurance application covers.

A properly conducted HIPAA Security Risk Analysis produces much of the evidence an underwriter asks to see. It documents each safeguard and its status, so the organization can describe its controls in specific terms.

The overlap maps cleanly:

• HIPAA access and authentication requirements line up with the MFA and access questions on both applications.
• HIPAA encryption safeguards line up with the questions about data at rest and data in transit.
• HIPAA contingency planning lines up with the questions about backups and recovery.
• The HIPAA risk analysis sits underneath the whole file as the record an underwriter wants to confirm.

One body of work supports all of it: the risk analysis and documentation an organization maintains for HIPAA is the same material that answers a cyber application and, more often than not, a professional liability renewal.

A cyber incident can be a surprise opportunity for your business: The Cyber Incident Near-Miss as a Free Cybersecurity Audit

How a Single Gap Turns Into Two Problems

A missing control does not stay contained to one policy. The same weakness can reach both files, and it can do so at two separate moments.

The first moment is the application. A thin answer about MFA or backups can raise the premium or narrow the terms on a cyber policy. That same answer can draw follow-up questions, or a higher rate, on a professional liability renewal that now asks about the control. One gap, two pricing conversations.

The second moment arrives after an incident, and it carries even more weight. Cyber carriers now verify the controls an applicant described, and misrepresented controls have become a leading reason claims are denied. Policies also tend to exclude losses tied to security practices an applicant misstated on the form.

Here is where the two policies meet: Answering yes to a control question without the technology behind it creates the same exposure on a malpractice renewal that it creates on a cyber application. A claim the organization expected to be paid can come back contested on either policy.

The underlying risk is not small. More than 61.5 million healthcare records were breached in 2025, according to the HIPAA Journal. An organization that files a claim after an incident wants the answers on its applications to hold up under review.

Documentation That Answers Both Rules

Because both applications draw on the same safeguards, one maintained evidence set can serve both. The work an organization does for HIPAA becomes the work that supports a renewal.

A useful evidence set includes:

• A current Security Risk Analysis, with findings and the status of each remediation item
• Records that show deployed controls such as MFA, encryption, access management, and activity logging, each dated when implemented
• Backup documentation that includes proof of a recent recovery test
• An incident response plan that lists responsibilities and roles
• Vendor and business associate records for every partner that handles patient data

Two habits keep that material ready: answer each application from what is deployed and verified, and refresh the documentation as the environment changes. A risk analysis from three years ago describes a network that no longer exists.

Kept this way, the same file carries an organization through a HIPAA review and both insurance renewals without a separate scramble for each.

The HIPAA Security Rule: Where Is It Heading?

The overlap between these controls and the insurance questions is set to tighten. In January 2025, HHS proposed the first major update to the Security Rule since 2013. The proposal would make several safeguards mandatory, including MFA and encryption of patient data at rest and in transit. It would remove the older flexibility that let organizations treat those controls as optional where they documented an alternative.

The proposal describes the Security Rule as a floor for cybersecurity in healthcare. The same safeguards insurers verify today would become a federal baseline.

One point matters for planning: as of late 2026, the update is still a proposal and has not been finalized. HHS published the notice on January 6, 2025, the comment period closed that March, and federal planning estimates now point to 2027 for final action. The current Security Rule governs until then.

Have One Answer, Ready For Both

Two insurers asking the same HIPAA question is a signal worth reading. Underwriters and regulators draw from the same place: the documented security posture behind your patient data. Getting it right once, and keeping it reliably up-to-date, is what lets a single answer hold up wherever it appears.

Louisville Geek is an in-house IT and security partner for regulated healthcare organizations. We build the controls HIPAA calls for, and maintain the documentation that cyber and professional liability underwriters ask to see.

Our team can conduct a healthcare IT compliance review to show where your controls and your paperwork stand today, so you can walk into your next risk assessment, and your next renewal, with the same answer ready for both.