Dental Practice Cyber & HIPAA Breach Insurance

What cyber liability insurance does for a dental practice

Cyber liability insurance is the policy written for data events: a breach of patient records, a ransomware lockout or a hijacked email account. A dental office holds plenty of that data, from charts and CBCT images to insurance subscriber numbers and payroll files.

Cyber policy wording varies from insurer to insurer, but the coverage generally comes in two halves.

Your own costs (first party). A breach coach and legal guidance on notice duties, forensic investigators, patient letters and a call center, credit or identity monitoring offers, data restoration, ransomware response, and business income lost while your network is down.
Claims against you (third party). Patient lawsuits after a breach, defense in regulatory investigations by HHS or a state attorney general, and fines or penalties where the law allows them to be insured.

Your other policies do little here. The standard business owner's form includes only $10,000 a year for restoring electronic data and $10,000 a year for income lost to a computer outage, and the income piece applies only to a short list of named causes. Liability forms often carry a data-breach exclusion added by endorsement.

The HIPAA notice rules a breach sets off

The HIPAA Breach Notification Rule applies when unsecured protected health information is breached. A practice must notify each affected patient without unreasonable delay, and no later than 60 calendar days after discovering the breach. The 60 days is the outer limit, not a target. The clock starts on the first day anyone on your team, other than the person who caused it, knew or reasonably should have known.

A breach involving more than 500 residents of one state or jurisdiction also requires notice to prominent media outlets serving that area. HHS must hear about any breach of 500 or more people at the same time as the patients do. Smaller breaches go into a log and are reported to HHS no later than 60 days after the calendar year ends.

A business associate, such as your IT provider, billing service or cloud software host, must tell you without unreasonable delay, and in any case within 60 calendar days of finding a breach on its side. That means its clock and yours can overlap. For what the rule asks of your practice, go to HHS's Breach Notification Rule page and talk with your attorney or privacy officer. We explain the rule; we don't give compliance advice.

HIPAA civil penalties are set per violation and scale with how culpable the practice was. As adjusted on January 28, 2026, they run from $145 per violation in the lowest tier to $2,190,294 in the highest, with a calendar-year cap of $2,190,294 for identical violations. HHS adjusts the figures every year. Under a 2019 enforcement notice, it also applies lower annual caps to the three less culpable tiers.

Get a quote for your dental practice →

Practice manager at a workstation with patient records software, no readable data

What a dental cyber policy usually covers, and what it often leaves out

What it usually covers	What it usually doesn't
Forensic investigation and a breach coach	Upgrading systems beyond what you had before, unless added back
Patient notices, call center and credit or identity monitoring offers	Bodily injury and property damage
Restoring data and repairing systems	Incidents you knew about before the policy began or its retroactive date
Ransomware response, and payments where lawful	War and hostile acts (wording varies)
Income lost while your network is down	Outages at the power or internet provider, on many forms
Defense in HHS or state attorney general investigations	Fines that can't be insured under your state's law
Patient lawsuits after a breach	Losses tied to a failure to keep promised security controls, with some insurers
Spoofed-payment losses, if a social engineering endorsement is added	Promises you made in contracts beyond what the law imposes

Many cyber policies are claims-made, so the retroactive date matters when you switch insurers.

How a data event plays out in a dental office

These examples are made up, and each tests a different piece of the policy.

Example scenario: a reused password at a periodontal office

A two-location periodontal practice lets its office manager log in to the server from home, with the same password as an old shopping account. On a Friday night, an attacker gets in, copies files and then encrypts the server along with the backup drive plugged into it. Monday's schedule won't load. The cyber policy may cover the forensic team, rebuilding the server and the income the office loses while it's closed. Because files were copied first, it may also pay for patient notices and monitoring offers.

Example scenario: an associate's laptop from a car

On a Thursday, a pediatric associate takes an unencrypted laptop home to finish treatment notes. It holds exported radiographs and parent contact details, and it's stolen from her car that evening. No hacker touched the network, but this can still be a breach of unsecured patient information. The policy's breach response coverage is the part that may respond: legal guidance, notices and the call center.

Example scenario: an inbox someone else was reading

An orthodontic group's billing lead signs in to a fake login page on a Monday. For three weeks, an outsider reads the inbox, which holds insurance attachments and treatment estimates. Then a "payroll update" email asks the office to move a hygienist's direct deposit. Forensics and notices fall under breach response. Money sent to the fraudster usually needs a social engineering endorsement, which is often sublimited.

The gap that catches the most dental offices

A vendor's outage may not count as your outage

Your practice runs on systems you don't control, like a claims clearinghouse or cloud practice-management software. If one goes down, your office can be fine and still unable to bill.

That happened in February 2024. A cyberattack on one of the largest U.S. healthcare claims clearinghouses kept many dentists from sending electronic claims and attachments to insurers, and two weeks later ADA News was still reporting the problem. The ADA pointed practices to payer portals and paper claim forms until service returned, and HHS acknowledged providers' cash-flow worries while claims and payments were stalled.

Whether a cyber policy pays for that kind of loss depends on its dependent (or contingent) business interruption wording. Some policies cover an outage at any outside provider. Others set a lower sublimit or cover only attacks on your own network. Ask about it by name.

What changes the price of cyber coverage

Cyber underwriters price the practice's data and its defenses. Expect questions like these:

Multi-factor authentication on email, remote access and the practice-management system.
Backups that are kept offline or can't be changed, and how often they're tested.
Endpoint protection on every front-desk, operatory and imaging workstation.
Phishing training for the team, and how payment or payroll changes get verified.
How many patient records you hold, and how many locations share a network.
The limit, the retention and the sublimits you pick, especially for social engineering and vendor outages.
Past incidents, even ones that cost nothing.

These are underwriting questions, not a list of what the law requires of your office. What the rest of your program costs depends on your building and equipment values, your revenue and payroll, how many locations and team members you have, the limits you choose and your claims history.

Get a quote for your dental practice →

Which practices need cyber coverage most

Any office with digital charts carries this risk. Some carry more.

Solo owners often have no in-house IT, and the owner's email doubles as the practice's. Insurance for solo practices
Group practices share one server and one inbox culture across several dentists and a larger front desk. Group practice coverage
Multi-location groups link offices on one network, so a single weak login can reach every location. Coverage for dental groups and DSOs
New owners inherit years of patient records on the first day. Our practice purchase checklist covers the timing.

State breach laws add their own deadlines

Many states add breach statutes of their own, and some reach dental practices even when HIPAA applies.

California sets a 30-day deadline from discovery, and a breach requiring notice to more than 500 residents means a sample notice goes to the Attorney General. California dental practice insurance
Colorado sets a 30-day limit as well. Where its timeline conflicts with HIPAA's, the shorter deadline controls. Colorado dental practice insurance
Texas requires notice to the Attorney General within 30 days for a breach involving at least 250 Texans, and the reports are posted publicly. Texas dental practice insurance
New York expects a practice that reports a breach to HHS to tell the Attorney General within five business days. New York dental practice insurance
Ohio exempts HIPAA covered entities from its notice statute, and gives a defense in some breach lawsuits to businesses with a written security program that meets a recognized framework. Ohio dental practice insurance

Other states are on our state pages. Your attorney confirms which laws apply to a given breach.

Cyber insurance questions from dental offices

How long does a dental office have to notify patients after a data breach?

Under the HIPAA Breach Notification Rule, a practice must notify affected patients without unreasonable delay and no later than 60 calendar days after discovery. Some states set shorter deadlines, such as 30 days in California and Colorado. Check with your attorney about the specific breach.

Does cyber insurance pay HIPAA fines?

Sometimes. Many cyber policies include regulatory defense and pay fines or penalties only where they're insurable by law. Whether a given penalty is insurable depends on the policy wording and the state.

Does my business owner's policy cover a data breach?

Only in a small way. The standard BOP form includes $10,000 a year for restoring electronic data and $10,000 a year for income lost to a computer interruption, the second only for a short list of named causes. Breach response, patient notices and liability claims usually need a separate cyber policy.

Will cyber insurance pay a ransomware demand?

Many policies include cyber extortion coverage that can pay a demand where it's lawful, along with the costs of responding. Terms and sublimits vary from policy to policy, so read that section closely before you need it.

What do cyber underwriters ask a dental practice?

Most ask about multi-factor authentication, offline or unchangeable backups, endpoint protection and staff phishing training. They also ask how many patient records you hold, your revenue and any past incidents.

Ready to see what you'd pay?

Independent agents, 12+ A-rated carriers, and a licensed agent back to you within one business day.

Get a Quote Call (855) 234-2488

Cyber and HIPAA breach insurance for dental practices