HIPAA (US health data law)
A 1996 US federal law protecting health data held by health insurers, providers and their business associates, whose security and notification rules weigh heavily on the sector's cyber losses.
The Health Insurance Portability and Accountability Act of 1996, supplemented by the 2009 HITECH Act, sets US rules protecting identifiable health information held by covered entities, health insurers, health care providers and professionals, clearinghouses, and by their business associates. Three rules form its core. The privacy rule governs use and disclosure of data. The security rule requires administrative, physical and technical safeguards for electronic data. The breach notification rule requires, after a breach, informing affected individuals without unreasonable delay and no later than sixty days, and reporting to the Department of Health and Human Services, which publishes breaches affecting more than five hundred people. The department's Office for Civil Rights imposes penalties and concludes settlements. For cyber insurance, health care is one of the hardest-hit sectors, because its data sells at a high price, its systems are old and interrupting care creates pressure to pay. The notification obligations and the class actions that follow make data breaches a particularly costly liability loss there.
After the 2015 breach that exposed the data of nearly 79 million people at a large US health insurer, the Office for Civil Rights reached a 16 million dollar settlement in 2018, then the largest in its history, on top of the sums paid in class actions.
HIPAA, Health Insurance Portability and Accountability Act, HIPAA breach notification rule
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.