Quick answer
Map plausible platform incidents to the proposed policy wording with a licensed insurance adviser. Distinguish first-party costs, third-party claims, supplier dependencies, conditions and exclusions. A supplier’s insurance certificate or a policy headline limit does not establish the nursing facility’s own coverage.
Describe the dependency before discussing the limit
A SNF's clinical and billing work depends on hosted applications, connectivity and outside service providers. A cyber event at the facility and an event at a supplier may interrupt similar work while engaging different policy provisions.
The NAIC and FTC cyber-insurance guide distinguishes first-party and third-party coverage and prompts consideration of data held by outside providers. Use that educational framework to prepare a discussion with a licensed insurance adviser. The actual policy, endorsements and facts determine coverage; this guide does not recommend a carrier, limit or legal interpretation.
Build an incident-to-cost map
This original worksheet helps the adviser examine the actual wording:
| Hypothetical event | Costs or claims to examine | Policy questions |
|---|---|---|
| Facility credentials expose resident records | Investigation, legal review, notices and possible claims | Covered event, response providers, consent and notice conditions |
| Hosted EHR interruption | Extra work, lost income and restoration dependencies | Covered supplier, trigger, waiting period and measurement method |
| Data corruption | Recovery, validation and re-entry | Covered cause and recovery-cost definition |
| Fraudulent supplier bank change | Transferred funds and investigation | Social-engineering/funds-transfer wording and conditions |
| Claim alleging privacy harm | Defense, settlement or judgment | Liability coverage, exclusions and defense arrangements |
Do not label any row “covered” until the adviser has reviewed the policy and circumstances. Keep uncertain interpretations as open questions requiring written clarification where appropriate.
Reconcile the application to operating facts
An insurance application may ask about MFA, backups, monitoring or remote access. Answer from verified scope. If MFA covers the EHR but not a remote-support service, an unqualified “all access” answer can misrepresent the environment. Ask the adviser how to respond accurately when controls vary by system or site.
Retain the submitted application, supporting evidence and any clarification. Establish how material changes are reported under the actual policy: new facilities, different hosting, new remote access or a major service change may need attention. Do not assume a vendor questionnaire and the insurer's question mean the same thing.
Model the facility's retained exposure
Suppose a fictional interruption scenario creates $180,000 of eligible loss under an adviser's assumed interpretation, with a $25,000 retention and a $100,000 applicable sublimit. For this exercise only, assume the retention is subtracted from that loss before applying the insurer-payment sublimit: the smaller of $180,000 − $25,000 and $100,000 is $100,000. That assumed payment leaves $80,000 with the facility. A policy that applies its retention or sublimit differently can produce another result. This is not a coverage estimate.
The purpose is to make assumptions visible. Also identify costs outside the modeled category and the cash needed while a claim is being adjusted. Avoid treating insurance proceeds as immediate operating cash or a substitute for a continuity plan.
Align incident response with claims conditions
Confirm notification routes, required timing, approved response firms, consent requirements and emergency arrangements with the adviser and response team. An incident may require urgent care-continuity actions while claims steps proceed. Put the relevant contacts in an accessible response plan without sharing policy or resident information broadly.
Rehearse a supplier incident where the facility initially lacks an affected-record count. The team should know how to notify appropriate parties, preserve evidence and update facts without making unsupported coverage or breach conclusions.
Use the review in platform selection
Compare supplier dependencies, available incident evidence, recovery responsibilities and contract limitations alongside insurance questions. A platform decision that adds an unexamined processor or unsupported legacy component may change the risk profile even if the annual premium is unchanged.
The useful output is a documented set of actual policy answers, unresolved gaps and operational actions. It gives leadership a basis for deciding retained risk and investment without implying that buying cyber insurance guarantees reimbursement after every incident.
Questions & answers
Does the EHR supplier’s cyber policy insure the facility?
Do not assume so. Review the actual contractual and policy arrangements with the appropriate advisers; a certificate alone does not establish the facility’s rights or coverage.
Can a policy’s headline limit be used as the recovery estimate?
No. Retentions, sublimits, waiting periods, exclusions, covered causes and claims conditions may affect the result. Actual policy wording controls.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.