The Cyber Insurance Market for Hospitals

II.A Sector Under Siege

The ideal target

The hospital has everything a ransomware crew looks for. It holds medical records, some of the most sensitive and saleable data there is. Above all, it cannot tolerate downtime, because any stoppage puts patient safety at risk. That makes it a likely payer. A hospital whose critical systems are locked is under heavy pressure to get running again fast, even if it means giving in to extortion. Criminal groups know this well. They focus on a sector where the odds of payment are high and the ability to resist is low, and they turn the victim's distress into profit. The hospital's vulnerability comes from its mission itself, which leaves it no room to wait an attacker out.

An intensifying pressure

The figures translate a rapid intensification of this pressure. The average cost of a healthcare data breach reached 7.42 million dollars in 2025, the highest of any sector for the fourteenth consecutive year. Some projections put it above twelve million by the end of 2026, with growth about twice as fast as in other industries³. The healthcare sector recorded several hundred ransomware incidents in 2025. Heavy financial losses also became far more common, and the number of healthcare organizations with losses above a certain threshold quadrupled in a year⁵. Extortion-only attacks, where nothing is even encrypted, have also tripled. The threat of leaking medical records is now enough to make victims give in⁶.

Disruption that has become systematic

Beyond the cost, it is the omnipresence of disruption that strikes. Nearly all healthcare organizations report having suffered dozens of attacks in a single year, and most of these attacks actually disrupt care, through delayed procedures, longer stays or patients diverted to other hospitals⁹. Sector projections expect most hospitals to see ransomware degrade their care before long, and healthcare to remain the most targeted sector for years¹⁰. Disruption is no longer a rare event. It has become a near-permanent part of hospital operations. For the insurer, that moves the risk away from a rare hazard and closer to a high base frequency.

III.The Risk That Crosses Every Cover

A claim that triggers almost every clause

The singularity of the hospital cyber claim lies in the fact that it simultaneously triggers almost every section of a policy. Double extortion is now the norm. The attacker encrypts the data and threatens to publish it, and that one move hits crisis management, liability for the health-data breach, business interruption, data restoration costs and the extortion cover itself⁴. One event triggers coverages that policies usually keep separate. Exposure gets harder to assess, and several costs pile onto one claim. An ordinary attack touches one or two coverages, a hospital attack almost all of them. That stacking inside a single claim is the first source of severity.

The blurred frontier of cyber and bodily injury

But the real difficulty lies elsewhere, in the crossing of the frontier between cyber and bodily injury. When an attack leads to a patient's death or a worse outcome, it opens the door to malpractice and bodily injury claims. Those can cost far more than the ransom or the data restoration. Yet cyber policies usually exclude bodily injury and property damage: these consequences fall to medical liability insurance, which was not priced for a systems outage and does not always say whether it covers one. The gray area sits between the cyber policy and the medical policy. The real tail of hospital cyber risk is the malpractice litigation that follows a systems failure, far more than the ransom, whose amounts are falling. Models built for data breach cannot price that poorly defined exposure.

This difficulty of characterization has a direct consequence on the assessment of exposure. If you think in data-breach terms, you can estimate the maximum claim from the number of compromised records and the unit cost of notification. That exercise is bounded and fairly well understood. Add bodily injury and the ceiling becomes far less certain. A single failure that causes several deaths can bring liability suits worth far more than the data ever cost. An insurer that takes this on is covering a risk whose upper bound it barely knows. It can cap the cover tightly, which hurts the insured, or reserve heavily, which hurts the price. That uncertainty about maximum severity, more than attack frequency, is what makes hospital risk so hard to carry.

IV.Accumulation Through the Vendor

The lesson of Change Healthcare

On top of the severity of each claim, the sector carries its own accumulation risk. The February 2024 attack on Change Healthcare showed it most clearly. Almost every American provider uses this health-payment processing platform, and its compromise affected around 192.7 million people, more than half of the population, and disrupted some 94% of the country's care providers⁷. The event shows that hospital cyber risk is correlated as well as individual. Shared vendors, such as payment platforms or electronic patient records, can fail and hit thousands of hospitals at once. A single upstream compromise can thus trigger a catastrophe on the scale of an entire health system⁸.

A correlation that defies risk pooling

This accumulation through the vendor reproduces, in the healthcare sector, the systemic problem this series has already analyzed in relation to shared technological dependencies. When thousands of insureds rest on the same infrastructure, their risks cease to be independent, and a single claim can strike the whole portfolio, destroying the diversification on which insurance lives. The healthcare cyber insurer thus carries a correlated exposure it does not control well, especially since it has no say over how concentrated the critical-vendor market is. And unlike other sectors, this one cannot simply be dropped by insurers. Its role is too vital to leave it uncovered, which puts the market in a real bind.

V.A Market at an Inflection Point

Insurability under strain

The hospital thus brings together everything that makes a risk hard to insure. It is the most attacked, because its mission makes it pay. Its data breaches are the most expensive of any industry. And its claims are sometimes counted in lives. Together, this has hit the healthcare cyber insurance market hard. Observers say it has reached an inflection point, with attack frequency up around 90% in 2025 and a loss cost that more than doubled⁴. A market under that kind of strain tends to harden, with higher premiums, less capacity and more exclusions. The danger is that cover becomes out of reach exactly where it is needed most.

From indemnity to resilience

In response, the market is starting to make cover depend on resilience instead of just paying claims. Insurers now require concrete controls such as tested backups, network segmentation and rehearsed recovery plans. Whether cover is granted, and at what price, depends on them, which turns the policy into a prevention tool. Regulatory pressure is growing at the same time. In the US, bills target healthcare cybersecurity and health-data protection rules are being updated. In Europe, hospitals now fall within the scope of critical infrastructure subject to stricter obligations¹¹. Cover becomes an incentive to invest in security as well as a transfer of risk. In a sector where the claim is too serious to simply pay out, that is the only sustainable path.

This shift has limits, though. Resilience costs money, and not every hospital can pay for it. Large hospital centers can invest in security and meet the insurer's conditions. Smaller facilities, often the most fragile, may be refused cover or charged prohibitive premiums because they cannot fund the required level of protection. A fracture thus takes shape, where cyber insurance would protect the best-endowed hospitals while leaving the most exposed without a net, aggravating an inequality that the public-service mission of care makes hardly acceptable. The market, left to its own logic alone, therefore tends to concentrate protection where the risk is best mastered, and to withdraw it where it would be most necessary, a paradox that reinforces the argument for a corrective intervention by the public authority.

VI.Insuring the Hospital, or Insuring the Patient

Rethinking the product itself

Hospital cyber insurance cannot stay a lightly adapted data-breach product. It has to be rebuilt around what it really covers, the operational resilience of a vital activity and the bodily injury that can follow. That means pricing in the bodily tail of the risk, the deaths and resulting malpractice that current models underestimate. The cyber policy carries it if it buys back its bodily injury exclusion, and the medical policy does otherwise. The hospital cyber claim also has to stop being treated as just another IT claim. The product must follow the risk from the server to the patient's bedside, and recognize that life matters more here than data. Fair pricing depends on this rethink, because you cannot insure a risk correctly if you have described it wrongly.

The systemic share calls for a collective net

That leaves the systemic share of the risk, accumulation through critical vendors, which looks too big for the private market alone. A compromise that hits almost an entire health system at once belongs with the risks this series has repeatedly flagged as needing a collective net, as sketched for cyber war or pandemics. Public pooling or state reinsurance for the catastrophic share of health-infrastructure cyber risk is a serious option. Without it, insurers could pull out of a sector they cannot carry alone. Insuring the hospital raises, in sharp form, the recurring question of how the market and the state share risks where failure cannot be tolerated. Behind the hospital's information system, the patient is always the one who must be insured¹².

This analysis finally illuminates the singular place of the hospital in the cartography of cyber risk that this series has gradually drawn. It concentrates, in a single object, the systemic accumulation of shared dependencies, the gray area between affirmative and silent coverages, the critical-infrastructure dimension subject to regulation and the prospect of a public net for the catastrophic share. As such, it acts as a litmus test, exposing in a harsh light tensions present elsewhere in a more diffuse way, but that the severity of bodily injury here makes impossible to ignore. Understanding hospital cyber insurance means understanding the limits of cyber insurability in general. It is the point where the risk stops being about costs and starts being about lives, and where the insurer finds that data was only ever a go-between for the machine and the human.