Cyber Liability…The Silent Killer

First, we want to recognize the behavioral health and social work professions as truly noble. They are founded on service, integrity, and clinical expertise. While these professions can be stressful and, at times, dangerous, they are also incredibly rewarding. The nation is grateful for what you do.

AND SO ARE WE! THANK YOU!

There is a saying by Mark Twain (the pen name of Samuel Clemens) that states: “It ain’t what you don’t know that gets you into trouble. It’s what you know for sure that just ain’t so.

There are many silent cyber liability risks affecting businesses and private practices. Following a cyber theft, we frequently see news reports about massive credit card database breaches and multimillion-dollar cybercrimes. Cybercriminals chase money in cyberspace much like shark’s chase blood in the water. Unlike a bank robber committing an armed hold-up, their weapon is a keyboard and computer. Cybercriminals often target large financial institutions and corporate databases. Others specialize in extorting medical practices by stealing patient records.

When it comes to cyber claims involving social workers, the most common claims involve client information breaches. Because most social work practices are relatively small, maintain limited cash reserves, and do not process large volumes of credit card transactions like banks or major retailers, they are generally not primary targets for financially motivated cyber theft.

Pro-Tip

However, social workers are exposed to a much more common liability risk arising from two types of client information breaches:

1. First-Party Breach

This incident occurs when the social worker (the First Party under the insurance policy contract) accidentally exposes a client’s confidential information through a misdirected email or fax. It could also occur if a burglar accesses client files in the social worker’s office but leaves them behind because they have no monetary value.

Preferra’s Professional Liability Policy covers this type of first-party claim, including incidents that must be reported to the state licensing board. Most professional liability insurance carriers do not cover this type of claim. Legal defense costs for responding to a licensing board complaint typically range from $1,500 to $2,500.

2. Third-Party Breach

This incident occurs when a third-party vendor—such as an electronic records provider, cloud storage company, billing service, or even a moving company handling client files—causes or contributes to a breach of your client records.

Professional liability policies generally do not cover these claims unless the policy includes a cyber liability endorsement or you purchase a separate cyber liability policy, which often requires a substantial additional premium. Defending these claims typically requires hiring an attorney, with hourly rates ranging from $250 to $850, plus an advance retainer of $5,000 to $10,000.

Preferra’s Cyber Liability Insurance Policy provides comprehensive protection at a lower cost than many other insurance carriers. Depending on the policy limit selected, the annual premium is approximately $100 for $12,000 in coverage. Preferra recommends a $25,000 Cyber Liability Policy, which is available for less than an additional $100 per year in premium.

Let’s take a closer look at a third-party breach.

The HIPAA/HITECH regulations, including 45 CFR Part 160 (General Administrative Requirements) and 45 CFR Part 164 (Security and Privacy), establish significant civil and criminal penalties for breaches involving protected health information. The Preferra Cyber Liability Policy provides coverage for many of the expenses associated with these incidents, including:

• Legal defense costs arising from claims made by clients, as well as civil actions brought by federal and state authorities.
• The cost of notifying every affected client in writing through the U.S. Postal Service, as required by law.
• One year of identity theft protection services for clients whose information was compromised.
• Civil fines and penalties, where insurable by law.
• The cost of hiring auditors and forensic investigators to determine the cause and extent of the breach.
• System restoration expenses.
• Advertising injury arising in connection with the breach.

Recent research indicates that third-party breaches—often referred to as supply chain risks—account for approximately 35% of all reported incidents, exposing more than 10 million client records annually. While these breaches may not receive the same media attention as attacks against large financial institutions or major credit card companies, they can still create devastating financial consequences for a small practice.

For peace of mind, purchasing a Preferra Cyber Liability Policy with $25,000 in coverage makes good business sense. The annual premium costs less than one cup of Starbucks coffee per month over the course of a year.