Guides
HIPAA breaches and cyber insurance for healthcare providers
How the HIPAA Breach Notification Rule, OCR penalties and state laws drive costs after a patient-data breach, and what a cyber policy does and does not pay.
A HIPAA breach starts a legal clock the moment you know, or should have known, that unsecured patient information was accessed or disclosed improperly. A cyber policy can pay for the investigation, the notification, the lawyers and some of the regulatory and lawsuit fallout, but it does not pay for the compliance failures that usually turn a breach into a penalty, and it will not cover everything a regulator or a plaintiff asks for. Where the policy responds depends on its wording, so read it against the HIPAA process below before you need it.
What counts as a HIPAA breach
Under the HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414), a breach is the acquisition, access, use or disclosure of protected health information (PHI) in a way the Privacy Rule does not permit, which compromises the security or privacy of that information. The rule presumes any impermissible use or disclosure is a breach unless the covered entity or business associate shows a low probability that the PHI was compromised, based on a risk assessment of four factors: what information was involved, who got it, whether it was actually acquired or viewed, and how far the risk has been reduced (45 CFR 164.402).
Two points trip up providers. First, the burden of proof sits with you (45 CFR 164.414). Second, the notification duty applies to unsecured PHI, meaning information not rendered unusable, unreadable or indecipherable to unauthorized people. Encryption that meets HHS guidance is the practical safe harbor, which is why insurers and OCR both ask about it.
Ransomware deserves a note. HHS's ransomware fact sheet takes the position that when ransomware encrypts ePHI, the data was acquired by the attacker, so a breach is presumed unless you can document a low probability of compromise. See ransomware and cyber insurance: how claims work for the coverage side.
The clocks and who gets notified
| Who | Trigger | Deadline (45 CFR) |
|---|---|---|
| Affected individuals | Any breach of unsecured PHI | Without unreasonable delay, and no later than 60 calendar days after discovery (164.404) |
| HHS | 500 or more individuals | At the same time as individual notice (164.408(b)) |
| HHS | Fewer than 500 individuals | Log it; report within 60 days after the end of the calendar year of discovery (164.408(c)) |
| Prominent media | More than 500 residents of one state or jurisdiction | Within the same 60-day outer limit (164.406) |
| The covered entity | Breach at a business associate | The associate must tell the entity without unreasonable delay and within 60 days (164.410) |
A breach is treated as discovered on the first day it is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it (164.404(a)(2)). Waiting for the forensic report to be final does not stop the clock. Law enforcement can ask for a delay if notice would impede an investigation (164.412), but a verbal request holds for no more than 30 days.
Individual notice goes by first-class mail, or email if the person agreed to electronic notice. If contact information is bad for 10 or more people, you need a 90-day website posting or major media notice plus a toll-free number active for at least 90 days (164.404(d)). The letter has required contents: what happened, what information was involved, what people can do, what you are doing, and how to reach you.
HIPAA is a floor. data breach notification laws and what they cost covers the 50 state statutes, and many have shorter deadlines, attorney general notice or definitions broader than PHI. California's Confidentiality of Medical Information Act lets patients sue for nominal damages, and Texas applies its medical privacy law (Health & Safety Code ch. 181) to a wider group of entities than HIPAA does. See state privacy laws and what they mean for business insurance.
What OCR can do to you
HHS's Office for Civil Rights (OCR) investigates every reported breach affecting 500 or more people. In its report to Congress for calendar year 2024, OCR counted 663 such breach reports affecting about 242.9 million people, with hacking the most common category; the Change Healthcare incident, at roughly 192 million people, drove most of that total. State attorneys general can also enforce HIPAA in federal court under the HITECH Act.
Civil penalties follow four culpability tiers (45 CFR 160.404), adjusted for inflation in 45 CFR 102.3. The 2025 adjusted amounts, the latest in the eCFR in October 2026:
| Tier | Per violation | Calendar-year cap in the table |
|---|---|---|
| Did not know and could not reasonably have known | $145 to $73,011 | $2,190,294 |
| Reasonable cause, not willful neglect | $1,461 to $73,011 | $2,190,294 |
| Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 |
| Willful neglect, not corrected | $73,011 to $2,190,294 | $2,190,294 |
In a 2019 notice, HHS said it would apply separate, lower annual caps to the three lower tiers (84 FR 18151). Most OCR cases end in a negotiated resolution agreement plus a corrective action plan, usually monitored for years. The monitoring and the remediation work are often a bigger bill than the payment.
The finding that appears again and again is a missing or stale risk analysis. The Security Rule requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI, and a separate risk management plan to reduce them (45 CFR 164.308(a)(1)(ii)(A) and (B)). Under Public Law 116-321 (January 2021), OCR must also consider whether you had "recognized security practices" in place for the prior 12 months when it sets penalties, so documented controls can reduce the outcome.
On rulemaking: HHS proposed a Security Rule overhaul on January 6, 2025 (90 FR 898), which would make safeguards such as multi-factor authentication and encryption mandatory. We found no final rule as of October 2026. Insurers already ask for those controls on the application (MFA, EDR and backups: the controls cyber insurers now require).
What a cyber policy usually pays
Most healthcare buyers use a standalone claims-made policy with first-party and third-party halves (cyber insurance: what it covers for a business). Against a HIPAA event, the usual map looks like this:
| Cost | Typical response | Watch for |
|---|---|---|
| Forensics, breach counsel, notification mailings, call center, credit monitoring | Breach response coverage, often with a separate limit | Panel vendor and consent requirements; per-record caps |
| Lost income and restoration after a ransomware shutdown | Business interruption and data restoration | Waiting period in hours; sublimit for ransomware (ransomware and cyber insurance: how claims work) |
| Defense of an OCR or attorney general investigation | Regulatory defense | Whether the named regulators include OCR and state AGs |
| OCR settlements and penalties | Often "where insurable by law" | Whether HIPAA fines are named; see are fines, penalties and punitive damages insurable? |
| Patient class actions | Privacy liability (third-party coverage) | Whether defense costs erode the limit |
| Cost of the corrective action plan | Frequently excluded or unaddressed | Ask for the wording; many forms call it ordinary compliance cost |
An OCR resolution payment is the gray area. Some forms insure "fines and penalties" where the law allows; others carve out amounts paid to resolve alleged non-compliance. Confirm in writing how your carrier treats a HIPAA resolution amount before you rely on it.
Where claims go wrong
- Late notice to the insurer. The HIPAA clock and the policy's reporting condition both start at discovery. Call the policy hotline first, then your breach coach. Vendors hired without consent may not be reimbursed (what happens when you file a cyber claim).
- Business associates. A billing company, EHR host or transcription service holds your PHI under a business associate agreement. If it is breached, you still notify patients, and the indemnity in that agreement may be exactly what the policy's contractual-liability exclusion removes. Look for a carve-back.
- Tracking technologies. Pixels and analytics tags on patient portals have produced class actions. OCR's 2022 online-tracking bulletin was partly vacated by a federal court in 2024, but the lawsuits did not stop. Wrongful-collection exclusions in some cyber forms can bite here.
- Application misstatements. Telling the carrier you encrypt all laptops and have MFA on email, then having neither on the day of the breach, invites a rescission or denial fight. See the cyber insurance application: what underwriters ask and how to answer.
- Malpractice does not respond. A medical malpractice insurance for physicians and practices policy covers professional services. It generally excludes data breach, so a privacy claim can fall between two policies.
A hypothetical: ransomware at a six-physician practice
Say a six-physician specialty practice finds its scheduling server encrypted on a Monday. It is a hypothetical; the numbers are not benchmarks.
- Monday: the office manager calls the cyber policy hotline. The insurer assigns a breach coach and a forensic firm. Discovery is Monday, so day one of 60 starts.
- Week one: forensics finds the attackers were in the network for nine days and copied files. Counsel documents why the four-factor assessment cannot show a low probability of compromise.
- By week three: the practice has a list of affected patients, letters drafted and a call center on standby.
- Day 45 or earlier: notices go out. Because 500 or more people are affected, HHS is notified at the same time, and counsel checks whether media notice is triggered in each state.
- Months later: OCR opens an investigation and asks for the risk analysis. Whether the practice has a current one, dated before the attack, shapes everything that follows.
Before you renew
Pull your last risk analysis and confirm it is dated within the past year and covers the systems that hold ePHI. Match your encryption, MFA, backup and access-termination practices to the application answers. Ask your broker to confirm in writing the regulatory coverage wording, any HIPAA sublimit, and whether business associate indemnities are covered. The cyber insurance readiness checklist is a starting point, and Medical practice insurance, Dental practice insurance, Home health care insurance and Counselor and therapist insurance each carry their own data and vendor profile.
Key takeaways
- The 60-day notification limit runs from discovery, which includes when you reasonably should have known, not from the end of the forensic report.
- OCR's enforcement turns on a documented, current risk analysis and risk management; a policy cannot supply what the Security Rule requires.
- Cyber policies typically fund response, defense and some liability, but fines are covered only "where insurable" and corrective action plan costs are often left out.
- Review business associate agreements and the policy's contractual-liability wording together, and notify the insurer at the same time you start the HIPAA clock.