Cyber Liability Insurance for Medical Billing and Revenue Cycle Companies
You are a HIPAA business associate, which means your breach becomes every client practice’s breach on a clock you start. Cyber Insurance Group has agents dedicated to cyber liability, comparing coverage across 12+ A-rated carriers.
Compare your billing company across 12+ A-rated carriers in about 4 minutes. Free, no obligation, and no need to know your limits in advance. We are an independent agency, so the recommendation is based on what covers your risk, not on one carrier’s product sheet.
Get My QuoteOne Incident, Every Client’s Patients
A billing company concentrates the records of dozens of practices into one system, which is exactly what makes it worth attacking.
Aggregated patient data
You hold demographics, diagnoses, insurance identifiers and payment detail for every practice you serve. The attacker gets all of them in one move.
Contractual liability
Every business associate agreement you have signed carries indemnity language. A single incident can trigger all of them simultaneously, from clients comparing notes.
Payment redirection fraud
You send and receive remittance instructions all day. That makes you a credible sender to impersonate and an attractive mailbox to compromise.
Clearinghouse dependency
Your own operations rest on clearinghouses and payer portals you do not control, so an outage upstream stops your revenue and your clients’ alike.
Sixty Days, and the Clock Starts With You
Two obligations sit in the Breach Notification Rule, and the second one decides how much your incident costs.
Your obligation to the practice
Following discovery of a breach of unsecured protected health information, a business associate must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovery. To the extent possible you must identify each affected individual and supply what the practice needs for its own notice. Source: 45 CFR 164.410.
Do not wait for a clean picture
The Office for Civil Rights has stated that because the supporting information may follow the initial notice, a business associate should not delay notifying the covered entity in order to collect the information needed for the patient notification. Source: HHS OCR.
What happens on the practice’s side
Your notice starts their clock. A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, and where 500 or more individuals are affected it must notify the Secretary contemporaneously rather than in the annual batch. 45 CFR 164.404 and 164.408.
They can hand the work back to you
A covered entity may delegate the notification task to its business associate, while remaining ultimately responsible for ensuring notifications occur. When Change Healthcare was attacked in February 2024, its parent offered to make notifications on behalf of affected providers, and OCR opened investigations into both companies. The lesson for a billing firm is that the notification bill is negotiable in your clients’ direction, and frequently lands on you.
How healthcare practices actually differ
- Behavioral health and addiction treatment are governed by HIPAA plus 42 CFR part 2. Consent rules far stricter than HIPAA.
- Medical billing and revenue cycle companies are governed by HIPAA, as a business associate. 60 days to notify the practice, not patients.
- Dental practices are governed by HIPAA, as a covered entity. 60 days to patients, sooner to HHS at 500+.
- Veterinary practices are governed by No HIPAA at all. State breach laws only, with no federal floor.
Why it changes the policy conversation
Your worst case is not one lawsuit, it is thirty clients invoking thirty indemnity clauses while you fund a notification you did not budget for. Limits sized to a single practice will not reach it. Our data breach response guide walks through the sequence.
Sized for the Whole Client Book
Notification at scale
Breach response coverage funds the mailing, the call center and the monitoring when the affected population is every patient of every client.
Claims from your clients
Third-party liability and contractual liability, where the policy grants it, respond when practices come back under their business associate agreements.
Fraudulent payment instructions
Funds transfer fraud and social engineering coverage answer remittance redirection, the loss a crime policy may not reach.
Upstream outages
Dependent business interruption responds when a clearinghouse or payer platform you rely on is the one compromised.
Before You Decide
The objections we actually hear from business owners, answered straight.
Does a medical billing company need its own cyber liability insurance?
Yes, and relying on your clients’ policies is the common mistake. As a business associate you are directly regulated under HIPAA, not covered by someone else’s compliance. Your breach obligations, your liability to the practices whose patients were exposed, and your contractual indemnities under every business associate agreement you have signed all land on you, not on them.
How long does a business associate have to report a breach?
Without unreasonable delay and in no case later than 60 calendar days after discovery, and the notice goes to the affected covered entity rather than to patients. Discovery is not the day you finish investigating. A breach is treated as discovered on the first day it is known, or by reasonable diligence would have been known, to anyone at your company other than the person who caused it.
Do we have to tell the practice who was affected?
To the extent possible, yes. The rule requires a business associate to identify each individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, used or disclosed. You must also pass along the other details the practice needs for its own patient notice, either at the time you notify them or promptly as that information becomes available.
Should we wait until we know the full scope before notifying our clients?
No. Because the supporting detail is allowed to follow, the Office for Civil Rights has said plainly that a business associate should not delay the initial notification to the covered entity in order to collect the information needed for the patient notice. Waiting for a clean picture is how a defensible incident becomes a reportable failure.
Can our clients make us do the patient notifications?
They can ask, and many will. A covered entity may delegate the task of breach notification to its business associate, though under the HITECH Act and the Breach Notification Rule the covered entity remains ultimately responsible for ensuring the notifications happen. In practice that means the cost and logistics of notifying tens of thousands of patients can land on your desk for an incident you are already paying to investigate.
What does cyber liability insurance not cover for a billing company?
It does not pay the fees you have to refund or the contracts you lose, and it does not answer a professional liability claim about billing accuracy or coding, which is a different policy. It also will not rescue a business associate agreement you signed without reading the indemnity, so those are worth reviewing alongside the policy.
What Would Cyber Liability Insurance Cost Your Billing Company?
Pricing follows how many records you hold, how many practices you serve, your payment workflows and the controls you can evidence. See the breakdown in our cost guide, or get a number for your company.
Compare 12+ A-rated carriers for your firm
Free, no obligation, about 4 minutes.