Does Cyber Insurance Cover HIPAA Violations?

HHS’s Breach Notification Rule requires covered entities and business associates to provide notices after certain breaches of unsecured protected health information. Insurance does not replace those legal obligations. FTC guidance includes legal counsel and incident-related fees, fines, and penalties among possible first-party coverage areas, but each policy and applicable law control whether a particular expense or penalty is covered.

Check whether the form includes privacy-regulatory proceedings, defense expenses, and fines or penalties where legally insurable. Confirm whether the trigger requires a covered breach, whether the policy covers your role as a covered entity or business associate, and whether notice deadlines, prior acts, consent, or sublimits apply. Also review the business associate agreement for contractual duties; a contract obligation is not automatically insured.