Get Help With Insurance Buying and Renewals.
Get help buying coverage and managing renewals, with less paperwork for your team. Start with a free consultation.
Insurance Buying Guide for Healthcare IT Businesses
Before you sign a business associate agreement, security addendum, or uptime commitment, map what data your product handles, which entity provides each service, and what your company promises the customer. HHS guidance ties HIPAA roles to the data relationship; NAIC describes cyber coverage as customized, so compare the actual terms with your contracts.[1][2]
Which Insurance Should You Consider?
Consider technology errors and omissions (E&O), cyber liability, general liability, and commercial property. Start with the coverages tied to your day-to-day operations, then use the situations and buying questions below to compare your options.
Technology errors and omissions (E&O)
A provider relies on your software for records, scheduling, billing, diagnostic workflows, or patient-facing services.
Ask which software services, outputs, integrations, and customer commitments the proposed terms address, then check the exclusions, retentions, and sublimits.[1]
Ask Before Buying
Which products, integrations, and service levels appear in the application, and what exclusions, retentions, or sublimits apply to a customer claim?
Cyber liability
Your product or a subcontractor creates, receives, maintains, or transmits electronic protected health information.
HHS guidance says cloud providers maintaining ePHI for covered entities or business associates can be business associates. NAIC distinguishes first-party incident expenses from third-party claims and cautions that cyber terms vary.[1][2][3]
Ask Before Buying
Do the proposed terms address vendor-held data, response expenses, service interruption, regulatory inquiries, customer claims, and your contractual notice duties?
General liability
You open an office or data center, host customer visits, or send staff to install or support systems at care sites.
Compare the proposed terms with your premises, customer visits, installation work, and third-party property exposures.[4][5]
Ask Before Buying
Which locations, installation activities, customer sites, and third-party property exposures are included, and what exclusions apply?
Commercial property
You lease an office or own servers, networking equipment, or other physical business property.
List the equipment and locations with current values. Compare the schedule, covered causes, deductibles, and exclusions with your setup.[5]
Ask Before Buying
Which equipment and locations are listed, how are values determined, and what covered causes, deductibles, and exclusions apply?
Before You Sign the Customer Contract
Map each customer entity, vendor, and data flow before signing a business associate agreement or security addendum. If a cloud provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate, HHS treats it as a business associate even when the information is encrypted.[1]
List each uptime, backup and recovery, data-return, and security commitment in the service agreement. Ask how the quote addresses each promise.[1]
When the Product Adds a Clinical Feature
When a feature changes the ePHI your product handles or adds a cloud vendor, map the data flow and customer relationship. Ask the broker whether the application or current terms need to change.[1]
Keep cyber and technology E&O questions separate. Ask which terms address your own incident costs and which address claims about your software service, then compare those answers with your customer obligations.[2][3]
Providers to Compare by Coverage
Technology errors and omissions (E&O)
Alliance Risk
Spot Score
Review Score
Not enough ratings
Amelia Risk
Spot Score
Review Score
2.0/ 10
Cyber liability
Alliance Risk
Spot Score
Review Score
Not enough ratings
Amelia Risk
Spot Score
Review Score
2.0/ 10General liability
Alliance Risk
Spot Score
Review Score
Not enough ratings
Amelia Risk
Spot Score
Review Score
2.0/ 10
Commercial property
Alliance Risk
Spot Score
Review Score
Not enough ratings
CFC
Spot Score
Review Score
Not enough ratings
Common Questions
Does signing a BAA mean my insurance covers a breach?
No. A business associate agreement sets responsibilities between the parties; it does not determine what an insurance policy covers. HHS says a BAA addresses permitted data uses and safeguards, while NAIC says cyber policies are customized.[1][2]
Read the Full AnswerWhat should I compare between cyber and technology E&O quotes?
Start with the event and loss you are asking about: a data incident, a claim about software performance, or an interruption to a customer’s workflow. NAIC distinguishes first-party cyber costs from third-party claims; ask the broker to map each scenario to the exact terms rather than treating the policy names as interchangeable.[2][3]
Read the Full AnswerSources and Further Reading
- Guidance on HIPAA & Cloud Computing — U.S. Department of Health and Human Services, Office for Civil Rights. Questions 1–3 on cloud providers, BAAs, and risk analysis; Question 7 on mobile device access; SLA topics in Question 1
Map covered-entity, business-associate, BAA, SLA, and cloud-provider roles for your customer relationship.
- Cybersecurity — National Association of Insurance Commissioners, Center for Insurance Policy and Research. Cyber loss categories and customized-policy qualification
Review NAIC’s warning that cyber coverage is customized and generally distinct from property and CGL terms.
- Cyber Insurance: Cybersecurity for Small Business — National Association of Insurance Commissioners. First-party and third-party coverage sections; vendor-held data and defense wording prompts
Use NAIC’s first-party and third-party examples as questions for the proposed wording.
- Small Business Insurance — National Association of Insurance Commissioners. General liability and other types of business liability sections
- Commercial Insurance Guide — California Department of Insurance. Commercial property and commercial general liability topics
Spot, a product of Tools for Enlightenment, publishes this guide and works in the commercial insurance market. This is general buyer education; policy terms and state-specific obligations determine coverage and requirements.
Updated 2026-09-28. Editorial Policy
Get Help With Insurance Buying and Renewals.
Get help buying coverage and managing renewals, with less paperwork for your team. Start with a free consultation.