Most hospitals are uninsured or seriously under-insured for computer security breaches or employee identity theft exposures. Typical "crime coverage" provisions deal with tangible property thefts and would not cover theft of patient information and subsequent thefts utilizing that information. Malpractice policies typically would cover hospital losses for damages in claims for breach of medical confidentiality, but would not cover major expenses for notification, credit monitoring services, and other remediation expenses.

Other examples include:

Hackers Break Into Hospital Computer System

Akron Children's Hospital is notifying about 240,000 patients that someone hacked into its computer system and gained access to sensitive information, including Social Security numbers and bank account records. The computer breach happened over Labor Day weekend, but the hospital didn't alert the FBI until mid-October. It started notifying patients at the end of October.

To date, reports indicate that Children's has incurred more than $1 million in notification costs.

See full story at:

http://www.scmagazine.com/us/news/article/601539/hackers-breach-ohio-hospitals-databases-obtain-personal-information-240000/

Man Sues Hospital System Over Security Lapse

An Indiana man has sued a hospital system over a security lapse that might have exposed the private information of more than 260,000 patients. Greenwood resident, Michael Chaney, claims in his federal lawsuit filed in late October that The Sisters of St. Francis Health Services Inc. and its contractor violated federal HIPAA privacy laws and failed "to take reasonable corrective action," such as promptly notifying patients of the breach. It seeks damages, including no less than $5,000 for each affected class member. See full story at:

http://www.belleville.com/mld/belleville/news/politics/15895203.htm/

New Forms of Insurance Developing To Protect These Risks

Hospital risk managers and insurance personnel should be considering purchasing new "technology" policies that provide coverage for security and HIPAA expenses, acccording to William Bruno, a member of Johnson Insurance Services' healthcare unit and working from their Phoenix office. The unit serves healthcare providers nationally with insurance and risk consulting services from a home base in Madison, WI.

"The recent spate of healthcare systems being targetted for identity theft have created a serious need for this kind of insurance, and several new insurance products have come to market to specifically help cover this risk," Bruno said. For more information, Bruno can be reached at wbruno@johnsonins.com.