Health Records Breached: No CyberInsurance Payout Why? Stupidity

following story says that 32,000 patient records were placed on an insecure server on the Internet  within the Cottage Health System.

Unfortunately a simple Google search would reveal these patient records which is against the HIPAA privacy guidelines.

Apparently the Hospital did have cyberinsurance from Columbia Casualty  insurance

according to

cottagehealthsystems  Santa Barbara hospital within Cottage



As has been noted by Dark Reading (InformationWeek) there are several reasons that insurance does not ahve to payout (clauses)

* Not paying retroactively

* Terrorism – act of war

* Lack of coverage or negligence

some policies do not cover theft or outright negligence.


It obviously pays to read the fine print to see what exactly your cyberinsurance covers.

What is considered negligence? Is it placing a server with access to the internet? Is it badly designed passwords? Where does the standard for negligence lie?


Obviously the decision to place a number of patient records on the Internet has to make sense to somebody.


What about an IT person that was given a task to place a new software database which would allow doctors and patients easy access to their information?

The method and task of creating the new system is important. And in this day of cyber attacks how that is done is very important.

In this link  you can see that cyberinsurance does cover negligence(as mentioned above almost all breaches are due to some negligence), but encryption of mobile devices or otherwise is required.


The key is the last paragraph:

{The good insureds are focusing on this and making sure they reduce their risk where they can and then get into the insurance with the understanding that things can still happen no matter how prepared they are.}

In hindsight Cottage health Systems did not do proper diligence and thus is not due any insurance payout.


Do you want to do proper security diligence? Then contact Us we can help.



1 thought on “Health Records Breached: No CyberInsurance Payout Why? Stupidity”

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.