Cyber Insurance Just Became Non-Negotiable for Dental Practices

dental-practices">Cyber Insurance Just Became Non-Negotiable for Dental Practices

You have patient records for 5,000 people. Each record has name, address, social security number, medical history, treatment plans, and insurance information. A hacker gets in, encrypts your system, and asks for $50,000 to open it. You have two days to decide: pay ransom or lose patient data and face legal liability.

this is not hypothetical. This is happening to dental practices right now. And most practices don't have cyber insurance.

OPERATOR MATH

Your practice: 5,000 patient records, 3 providers, $2.2M annual revenue.

Breach scenario (uninsured):
Ransomware locks your system. Hacker demands $65,000.
You don't pay (FBI recommends against it). You hire IT recovery: $28,000.
Downtime: 12 days. Lost revenue: 12 days × $9,000/day = $108,000.
HIPAA notification letters: 5,000 × $2 = $10,000.
Credit monitoring (required): 5,000 × $3/person = $15,000.
Legal fees and regulatory defense: $22,000.
Patient attrition (estimated 8%): 400 patients × $450 lifetime value = $180,000 long-term loss.
Total cost: $363,000.

Breach scenario (insured with $4,500/year policy):
Same ransomware attack. Insurance covers:
IT recovery: $28,000 (covered)
Lost revenue (business interruption): $108,000 (covered up to policy limit)
Notification and credit monitoring: $25,000 (covered)
Legal/regulatory: $22,000 (covered)
Your out-of-pocket: $5,000 deductible.
Patient attrition: Still happens, but reputation management covered by policy reduces impact to 4% = $90,000 loss.
Total cost: $5,000 deductible + $90,000 attrition = $95,000.

Cost delta: $363,000 (uninsured) - $95,000 (insured) = $268,000 saved.
Annual premium: $4,500/year.
ROI: 60x in a single breach event.

Even if you're only breached once every 15 years, the break-even is $67,500 in total premiums vs. $363,000 in losses. You're covered after 15 years of premiums and still ahead by $295,500.

THE TAKEAWAY

Call a dental IT security company this week. Get a security assessment ($1,500-$3,000). Identify your gaps: MFA, backups, staff training, patching.

Implement the baseline controls needed for insurability: MFA on all accounts, automated off-site backups, annual phishing training, firewall updates. Budget $2,000-$3,000 for setup, $1,500/year ongoing.

Get 3-5 cyber insurance quotes. Compare coverage limits (aim for $500K minimum), deductibles ($5K-$10K is standard), and exclusions (ransom payment coverage varies). Choose a policy by January.

Document an incident response plan. One page: who to call (IT vendor, insurance company, lawyer), how to isolate systems, how to notify patients. Store it off-site (cloud, printed copy at home).

Review annually. Cyber threats evolve. Your policy and security controls need to evolve with them. Schedule a Q1 security review every year.