California healthcare organizations run on electronic health records, patient portals, billing platforms, cloud software and connected medical systems every day — which makes cyber risk an operational problem, not only an IT problem. A compromised mailbox can redirect a payment, and ransomware can interrupt scheduling, billing and access to critical records.
✓Patient Data Privacy
✓Ransomware
✓Incident-Response Expense
Reviewed by David Gleason, Principal — October 11, 2026
CaliforniaGeneral information only, not legal advice — illustrative scenarios and coverage, subject to change without notice. Content may be out of date or contain errors, and requirements vary by city, county, state, agency, project, contract, carrier and policy, among other factors; verifying what applies to your own situation is your responsibility. Full disclaimer
Prefer to send everything at once? Complete a streamlined submission — just needs your review. Especially worth it if your business does $2M+ in annual sales — it can meaningfully speed up carrier turnaround.
Interactive coverage guide
Build a coverage stack around how the business actually operates.
Start with the preselected industry or trade, then adjust the operational questions. The commonly considered stack updates live. Keep the coverages you want GIB to evaluate, remove ones you do not want included in your quote request, and add other available lines before continuing.
Common Starting Coverages
General LiabilityThird-party injury and property damage
What it is
General Liability commonly addresses covered third-party bodily injury, property damage and certain personal or advertising injury claims, subject to the policy.
Why businesses like yours commonly carry it
Businesses commonly use it as a starting liability policy and to satisfy customer, landlord or contract requirements.
Possible coverage gap
General Liability is not intended to replace policies for employee injuries, business vehicles, owned property, cyber events or professional errors.
Cyber Liability & Data BreachCyber events, data and system interruption
What it is
Cyber insurance may address certain first-party and third-party losses from covered data breaches, cyberattacks, ransomware and system interruption, depending on the policy.
Why businesses like yours commonly carry it
Medical and dental practices hold patient records and depend on EHR, scheduling and billing systems that attackers target.
Possible coverage gap
General Liability generally should not be assumed to address data breach response, ransomware or network interruption.
Business Owners Policy / Commercial PackageLiability and property components evaluated together
What it is
A Business Owners Policy commonly combines liability and property coverages for eligible businesses. A Commercial Package Policy may combine multiple commercial coverage parts depending on the account and carrier.
Why businesses like yours commonly carry it
Businesses with premises, contents, inventory or other property exposures may ask GIB to evaluate whether liability and property components can be packaged where appropriate.
Possible coverage gap
Eligibility, included coverages and package structure vary by carrier. Commercial Property may also be written separately rather than as part of a package.
Educational guidance only. Results are not a coverage recommendation, quote, binder, policy interpretation, or guarantee of coverage. Actual needs, availability, forms, limits, exclusions and requirements vary. A licensed insurance professional should review the complete risk and issued policy terms.
Verified Google reviews
What our cyber insurance clients say about us
5.0 / 5from 7 Google reviews
Reviews reflect individual client experiences and are not a guarantee of coverage, pricing or results.
91 Enterprise LLC
March 24, 2026
We are using Gleason insurance for our commercial auto policy and GL policy. David is the best insurance broker I've worked with — very honest, responsive, and knowledgeable. Highly recommend.
Fito Plumbers
February 20, 2026
We have been working with David at Gleason Insurance Brokers for 8+ years. David always goes above and beyond to make sure we have the appropriate coverages. He explains everything in detail and makes sure we feel confident and understand all of our policies. He is always available and responds right away!
Barry Stay
February 17, 2026
David provides great service and I highly recommend him for your insurance needs.
Why Medical and Dental Practices Draw Cyber Attacks
Healthcare combines valuable personal information with time-sensitive operations. A manufacturer can often pause a noncritical system during an investigation; a medical practice may still need to schedule patients, access records, process prescriptions and bill insurers regardless. That combination creates privacy liability, incident-response expense and lost-income exposure all at once.
California medical businesses often operate under multiple privacy and security requirements depending on the organization and the information involved, and cyber insurance should be reviewed alongside the practice's actual compliance responsibilities and incident-response plan, not treated as a substitute for either.
Patient data plus time-sensitive operations creates a distinct combination of risk
A medical practice usually can't just pause operations during an investigation
Privacy liability, incident-response expense and lost income can hit at once
Cyber insurance supplements compliance obligations — it doesn't replace them
What a Healthcare Cyber Policy Typically Pays For
Cyber coverage may respond to covered privacy events involving unauthorized access, disclosure or acquisition of protected patient information, subject to policy terms — breach counsel, forensic investigation, notification and credit or identity monitoring where applicable are the pieces to review closely.
Ransomware and cyber-extortion response services are typically part of the policy too, but sublimits, coinsurance, exclusions and security-control warranties can materially change the actual protection — backup quality and recovery testing often matter as much to underwriting as the requested limit.
Breach counsel, forensic investigation and notification costs are core coverage pieces
Ransomware/extortion response is typically included, subject to sublimits
Backup quality and recovery testing matter to underwriting as much as the limit
Security-control warranties can materially change what actually pays out
Patient Records, Practice Downtime and Who Can Claim
A practice's cyber losses split along two lines. The first is its own: forensic work to find out what was accessed, legal advice on notice duties, letters and credit monitoring for affected patients, restoring the EHR and scheduling systems, and the revenue lost when visits are canceled and claims cannot be billed. That income loss is often the largest piece for a medical group, because the waiting room empties the moment the schedule disappears.
The second line is claims brought by others: patients alleging their records were mishandled, a hospital or payer asserting a contract breach, or a regulator opening an inquiry. Under the HIPAA Breach Notification Rule, individuals must be notified without unreasonable delay and no later than 60 days after discovery, breaches affecting 500 or more people go to HHS within that window, and breaches touching more than 500 residents of a state also require media notice. A cyber policy's regulatory coverage, where included and insurable, is written around those obligations.
Own losses: forensics, notice, restoration and canceled-visit revenue
Claims by patients, partners and regulators after an exposure
HIPAA: individual notice within 60 days of discovery at the latest
500 or more affected: HHS notice; over 500 in a state: media notice
Where Healthcare Exposure Lives: EHR, Portals and Billing
For a medical practice, the cost of a cyber event is often measured in canceled visits, delayed procedures and interrupted billing rather than in stolen records alone — network business interruption can be one of the most important parts of the policy, and the waiting period and restoration-period definitions deserve close review.
A compromised administrator, billing employee or executive mailbox can also be used to alter payment instructions or impersonate a vendor. Social engineering and fraudulent funds-transfer coverage are not automatically identical to network-security coverage, so limits and verification requirements should be checked before assuming they overlap.
Canceled visits and delayed procedures can cost more than the breach itself
Network business interruption deserves as much review as breach coverage
A compromised billing mailbox can redirect a real payment
Social engineering coverage is not automatically the same as breach coverage
California and Federal Rules for Patient Data
California has broad privacy and breach-notification requirements, but the exact obligations depend on the entity, the records involved and the event. California's privacy regulations also include cybersecurity-audit and risk-assessment requirements for certain covered businesses, on phased compliance dates.
A medical practice should not assume that buying cyber insurance satisfies these obligations — insurance and compliance serve different purposes, and both should be reviewed with qualified counsel where the facts are unclear.
California breach-notification obligations depend on the entity and the records involved
Cybersecurity-audit and risk-assessment rules are phasing in for certain businesses
Cyber insurance does not substitute for compliance obligations
Confirm applicable requirements with qualified counsel when the facts are unclear
An Illustrative Ransomware Event at a Medical Group
A threat actor takes over a billing employee's email and changes ACH instructions sent to a vendor — a loss that can implicate cyber, social engineering and crime coverage together, not any one policy alone.
In a separate pattern, ransomware disrupts scheduling and record access for several days during a busy week, forcing cancellations and manual processes — here, business interruption and restoration expenses can matter as much as the extortion payment itself.
This example is illustrative, not a report of an actual case or a promise of how any real claim would resolve — real outcomes depend on the specific policy, the facts involved, and the carrier's own review. For a situation that's actually happened or is happening, talk to your broker, a licensed attorney, or the relevant regulatory authority directly.
A compromised billing mailbox can redirect a real vendor payment
Ransomware during a busy week forces cancellations and manual workarounds
Business interruption and restoration costs can rival the extortion demand
This is illustrative — real claims depend on the actual policy and facts
Preparing a Healthcare Cyber Submission
A strong submission should describe annual revenue, employee count, number and type of records, EHR and major cloud vendors, use of MFA, endpoint protection, backup frequency and isolation, patch management, prior cyber incidents and payment procedures.
We place cyber programs for California medical, dental and allied-health practices and compare how each carrier treats regulatory defense, dependent EHR outages and the business-interruption waiting period. Call 844-978-7283 or request a quote with Cyber Liability selected.
Describe records held, EHR/cloud vendors, and MFA/endpoint controls in use
Note backup frequency, backup isolation and restoration testing
Disclose any prior cyber incidents and current payment procedures
Request a quote online, or call 844-978-7283
Frequently asked questions
10 questions — start typing to filter
What is cyber insurance for a medical practice?
For a healthcare organization, cyber insurance is mostly about what happens after protected health information is exposed: forensics, patient notification, credit monitoring, regulatory defense and fines where insurable, plus the income lost while systems are rebuilt. It is a separate policy from medical malpractice and from general liability, both of which typically exclude data incidents. Terms vary by policy.
Does a small medical practice really need cyber insurance?
Potentially, yes. A smaller practice can still hold valuable patient and employee information and depend heavily on email, cloud systems and an EHR platform — the appropriate limit should reflect the practice's records, revenue and interruption exposure.
Does cyber insurance cover HIPAA fines?
Some cyber policies may provide regulatory defense and certain penalties where insurable and covered by the form, but coverage is not automatic — the policy wording and facts of the matter control.
Will cyber insurance pay a ransomware demand?
A policy may include cyber-extortion coverage for covered events, subject to exclusions, legal restrictions, carrier consent and policy conditions — insurers increasingly evaluate MFA, backups and endpoint security when underwriting this exposure.
Is cyber insurance the same as medical malpractice insurance?
No. Cyber insurance generally addresses covered privacy, network-security and system-interruption events, while medical malpractice addresses allegations arising from professional healthcare services.
What security controls can affect pricing?
MFA, endpoint detection, backup segregation, restoration testing, patching and email security can all influence underwriting, along with prior incidents and the type and quantity of sensitive records.
How much cyber insurance should a medical group buy?
The limit should be based on records, revenue, contractual obligations, potential notification costs and interruption exposure rather than a generic rule — larger groups may also need excess cyber limits.
Are patient portals and EHR vendors covered?
A cyber policy may address certain dependent-service or vendor-related events, but the scope differs substantially by carrier — identify critical vendors and review the policy's definition of dependent systems.
What is the biggest cyber exposure for a medical office?
There is no single exposure for every office — patient data, ransomware, email compromise, vendor failures and interruption of scheduling or billing systems can all create significant losses.
How does healthcare cyber risk compare with a general business cyber policy?
The core coverage grants are similar, but a healthcare practice's business-interruption modeling needs to reflect canceled visits and billing downtime specifically. See the Cyber Insurance California hub for how this compares across other industries we place.
Official resources
Verify current licensing, regulatory and program requirements directly with the responsible agency — this is general information, not legal advice, requirements change without notice, and what is summarized here may be out of date or contain errors. Confirming what applies to your own city, project, contract and policy is your responsibility.
