Do Therapists Need Cyber Insurance? Yes, and Here's Why

Short answer: Yes, absolutely.

Why: Therapy notes are the most sensitive data that exists. One breach destroys your practice.

Why Therapists Are Targets

Cybercriminals target therapy practices because:

1. High-value data

1. Mental health records sell for 10x medical records on dark web
2. Embarrassment factor = higher extortion potential
3. Public figures, executives, and politicians see therapists

2. Weak security

1. Solo practitioners rarely have IT support
2. Home offices with consumer-grade security
3. "I'm too small to be a target" mindset

3. Easy access

1. Telehealth expanded attack surface
2. Cloud EHRs accessed from anywhere
3. Personal devices used for practice

What Cyber Insurance Covers

First-party coverage (your costs):

1. Ransomware payments
2. Data recovery and restoration
3. Forensic investigation
4. Business interruption
5. Notification costs
6. Credit monitoring for affected clients

Third-party coverage (others' claims):

1. Client lawsuits
2. Regulatory fines (HIPAA, state laws)
3. Legal defense costs
4. Settlement costs

Real Scenarios

Scenario 1: Laptop stolen from car

1. 500 client records exposed
2. Notification cost: $25,000
3. Credit monitoring: $50,000
4. Legal defense: $30,000
5. Settlement: $100,000
6. Total: $205,000

Scenario 2: Ransomware attack

1. Practice locked out for 2 weeks
2. Ransom demand: $50,000
3. Lost revenue: $15,000
4. Recovery costs: $20,000
5. Forensics: $15,000
6. Total: $100,000

Scenario 3: Phishing leads to breach

1. Attacker accesses EHR
2. 200 records exfiltrated
3. HHS investigation
4. Fine: $50,000
5. Notification: $10,000
6. Reputation damage: Immeasurable

What Cyber Insurance Costs

Solo practitioner:

1. $500-1,500/year
2. $1M coverage typical
3. Higher with telehealth

Small group (2-5 therapists):

1. $1,500-3,500/year
2. $1-2M coverage
3. Additional coverage for multiple locations

Larger practice (5-20):

1. $3,500-10,000/year
2. $2-5M coverage
3. Often bundled with professional liability

What Insurers Require

To get cyber insurance (or avoid claim denial), you'll need:

Basic requirements:

☐ Multi-factor authentication

☐ Endpoint protection (antivirus)

☐ Regular backups

☐ Employee training

Enhanced requirements (some carriers):

☐ Encrypted devices

☐ Email filtering

☐ Incident response plan

☐ Vulnerability scanning

Malpractice vs. Cyber Insurance

Your malpractice policy probably doesn't cover:

1. Data breaches
2. Ransomware attacks
3. HIPAA fines
4. Notification costs
5. Business interruption from cyber events

Check your policy. Most therapist malpractice policies exclude cyber incidents entirely.

How to Get Cyber Insurance

1. Through professional associations:

1. APA, NASW, and others offer group rates
2. Often cheapest option
3. Coverage may be limited

2. Through your malpractice carrier:

1. Add cyber as endorsement
2. Streamlined process
3. May not be comprehensive

3. Standalone cyber policy:

1. Most comprehensive
2. Best for practices with telehealth
3. Shop multiple carriers

Questions to Ask

Before buying:

1. Does it cover ransomware payments?
2. Does it cover regulatory fines?
3. Is telehealth specifically covered?
4. What security requirements must I meet?
5. Is 42 CFR Part 2 data covered? (substance abuse)
6. What's the claims process?

The Bottom Line

Cost of cyber insurance: $500-1,500/year

Cost of uninsured breach: $50,000-500,000+

Cost of losing your license: Everything

This isn't a hard decision.

Not sure if your practice meets insurance requirements? We help therapists implement the security controls insurers require. Get Free Assessment

Need Help With Your Practice’s Security?

Free assessment, no obligation, real answers.

Get Free Assessment

(469) 306-9520 • Serving Dallas-Fort Worth