When a ransomware note appears or a staff member reports a stolen mailbox, the first call many organizations make is to their cyber insurance hotline. What happens next is unfamiliar to most administrators, and unfamiliarity costs time. This post outlines the general sequence of a cyber insurance claim so you know what to expect.
Policies differ, so treat this as a general picture and read your own policy carefully. Your broker is the best source for the specifics of your coverage.
Most policies require prompt notice of an incident, and many include a dedicated breach response hotline. The intake team collects basics: what happened, when you discovered it, what systems are involved and whether protected health information may be affected. Have a short fact sheet ready, including your policy number, the hotline contact and the name of a decision-maker who can authorize actions.
Do not wait until you are certain the incident is serious. Late notice can complicate coverage, so when in doubt, ask your broker or the hotline.
Many insurers maintain a panel of pre-approved providers. After intake, you are often connected with:
Breach counsel, commonly called a breach coach, who directs the response and helps preserve privilege.
A digital forensics firm to investigate how the intruder got in, what they touched and whether they are still present.
Notification, call center and credit monitoring vendors, if notification of individuals becomes necessary.
Public relations support, where a public statement is likely.
Negotiation specialists, in ransomware events, if your policy covers extortion.
Policies often expect you to use these panel vendors, or to get approval before hiring others. Using an unapproved vendor without consent can create reimbursement problems, so check before engaging anyone outside the panel, including your own IT provider for work beyond routine containment.
Forensics determines scope: which systems were affected, which accounts were compromised and whether data left the network. This work informs the legal question of whether notification is required under HIPAA and state law. Your IT team or managed provider works alongside the forensic firm, supplying logs, network diagrams and access.
Keep records of every decision, action and time. Avoid wiping or rebuilding systems before the forensic team says it is safe, because evidence can be lost.
Counsel guides decisions about notifying affected individuals, HHS, state regulators and, where required, the media, following the HIPAA Breach Notification Rule and applicable state laws. Deadlines can be short, so preparation matters. Do not draft or send public statements without counsel review.
Insurers reimburse covered expenses, and they will want documentation. Track:
Invoices from panel vendors.
Internal overtime and staff time devoted to response.
Costs of restoring systems and data.
Business interruption details, such as lost revenue or additional expenses during downtime.
Coverage terms, waiting periods, retentions and sublimits affect what is paid, so ask your broker what your policy includes.
Payment may happen as vendors bill the insurer directly for covered services, or as you submit costs for reimbursement. Expect the insurer to review documentation, and expect some items to be questioned. A final close-out often follows once investigation, notification and recovery work conclude. Regulatory inquiries can continue after the claim itself seems finished, so keep your records.
Store the hotline number and policy details somewhere that does not depend on your network.
Review your policy's panel vendor requirements and notice provisions with your broker.
Know what security controls your application promised, since misstatements can affect coverage.
Include the insurer call in your incident response plan and practice it.
UnityCare IT can help you build an incident response plan that includes the insurance steps, keep the technical documentation your insurer and counsel will ask for, and work with your panel forensic team during an event. Preparing in advance makes the first hours calmer.
Security monitoring, HIPAA safeguards, backups and staff training for healthcare and small businesses.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172