Health systems having been hit by labor and supply chain costs and broader economic woes have another unwieldy financial problem—the soaring costs of cyber insurance.
Moody's Investors Service notes that, while it’s not sexy, the sheer size of cyber-crimes and insurers' reluctance to cover losses brought on by ransomware attacks are having a very serious impact on hospitals.
"The timing of the insurance price increase is bad for health care. There isn't much room for error, " said Matthew Cahill, a Moody's analyst. There have been double-digit increases in premiums over the past four years, often more than tripling in a single year. According to a recent analysis from Property Casualty 360, the industry's insurance costs have finally started to stabilize in the first quarter of 2023.
In an interview, Omid Rahmani, an associate director at the credit rating company Fitch Ratings, stated: "Costs are decelerating. That tells part of the story. But cyber insurance is becoming unaffordable or unavailable for a lot of small- to medium-sized issuers."
Early in the century, when cyber insurance first appeared, it was frequently incorporated into other policies. According to Rob Rosenzweig, senior vice president and head of the National Cyber Risk group at brokerage company Risk Strategies, when losses grew because of the assaults' growing frequency and sophistication, insurers were forced to develop stand-alone policies. In other words, the coverage was not priced appropriately for the level of risk assumed.
Insurance companies have been increasing the standards that health systems need to meet to strengthen their defenses and secure coverage. The new standards include strict data backup policies, the usage of tools like multi-factor authentication, personnel security training, and network segmentation.
"Social engineering attacks, such as phishing, remain one of the most effective ways to breach a hospital system. The workforce remains the weakest link," said Soumitra Bhuyan, a professor at Rutgers University and expert on heath care’s evolving cyber insurance landscape. Social engineering is often treated as a separate policy extension by insurers.
Other limitations have also been added to the coverage, such as the exclusion of cyberattacks supported by nation-states. This is being required because of a new requirement by Lloyds of London. Lloyds now requires all insurance groups that take part in its international insurance and reinsurance marketplace to exclude state-sponsored cyberattacks from their policies.
"With the increased rates and limited coverage, small independent and rural hospitals are at a significant disadvantage in obtaining cybersecurity insurance," Bhuyan said.
"The gap between those with adequate resources to protect their information systems continues to increase," Bhuyan said. "Many of these hospitals are critical access hospitals or hospitals in rural areas. They don't have enough resources to secure their IT systems and may be unable to recover if a breach happens."
Moody’s Cahill said that even though cyber insurance is becoming more expensive, the cost of a successful ransomware attack is still far worse. He pointed to an Illinois system that listed one such attack as a contributing reason for the temporary shutdown of two of its rural hospitals in January as evidence.
In January, the pro-Russian group Killnet took credit to taking down portions of systems of more than a dozen U.S. hospitals, including Stanford Healthcare, Duke University Hospital and Cedars-Sinai.
According to Fitch Ratings, these cyberattacks are unlikely to result in downgrades for not-for-profit health institutions, but the use of more advanced cyber-weapons that damage a hospital's financial profile and compromise service could.
While some health systems are doing well, for a majority, there is still very little wiggle room to have to operate a month or two on manual records, divert services, and deny claims. And if the attack results in a closure, rural communities simply can’t afford to have no emergency services.
Moody's Investors Service notes that, while it’s not sexy, the sheer size of cyber-crimes and insurers' reluctance to cover losses brought on by ransomware attacks are having a very serious impact on hospitals.
"The timing of the insurance price increase is bad for health care. There isn't much room for error, " said Matthew Cahill, a Moody's analyst. There have been double-digit increases in premiums over the past four years, often more than tripling in a single year. According to a recent analysis from Property Casualty 360, the industry's insurance costs have finally started to stabilize in the first quarter of 2023.
In an interview, Omid Rahmani, an associate director at the credit rating company Fitch Ratings, stated: "Costs are decelerating. That tells part of the story. But cyber insurance is becoming unaffordable or unavailable for a lot of small- to medium-sized issuers."
Early in the century, when cyber insurance first appeared, it was frequently incorporated into other policies. According to Rob Rosenzweig, senior vice president and head of the National Cyber Risk group at brokerage company Risk Strategies, when losses grew because of the assaults' growing frequency and sophistication, insurers were forced to develop stand-alone policies. In other words, the coverage was not priced appropriately for the level of risk assumed.
Insurance companies have been increasing the standards that health systems need to meet to strengthen their defenses and secure coverage. The new standards include strict data backup policies, the usage of tools like multi-factor authentication, personnel security training, and network segmentation.
"Social engineering attacks, such as phishing, remain one of the most effective ways to breach a hospital system. The workforce remains the weakest link," said Soumitra Bhuyan, a professor at Rutgers University and expert on heath care’s evolving cyber insurance landscape. Social engineering is often treated as a separate policy extension by insurers.
Other limitations have also been added to the coverage, such as the exclusion of cyberattacks supported by nation-states. This is being required because of a new requirement by Lloyds of London. Lloyds now requires all insurance groups that take part in its international insurance and reinsurance marketplace to exclude state-sponsored cyberattacks from their policies.
"With the increased rates and limited coverage, small independent and rural hospitals are at a significant disadvantage in obtaining cybersecurity insurance," Bhuyan said.
"The gap between those with adequate resources to protect their information systems continues to increase," Bhuyan said. "Many of these hospitals are critical access hospitals or hospitals in rural areas. They don't have enough resources to secure their IT systems and may be unable to recover if a breach happens."
Moody’s Cahill said that even though cyber insurance is becoming more expensive, the cost of a successful ransomware attack is still far worse. He pointed to an Illinois system that listed one such attack as a contributing reason for the temporary shutdown of two of its rural hospitals in January as evidence.
In January, the pro-Russian group Killnet took credit to taking down portions of systems of more than a dozen U.S. hospitals, including Stanford Healthcare, Duke University Hospital and Cedars-Sinai.
According to Fitch Ratings, these cyberattacks are unlikely to result in downgrades for not-for-profit health institutions, but the use of more advanced cyber-weapons that damage a hospital's financial profile and compromise service could.
While some health systems are doing well, for a majority, there is still very little wiggle room to have to operate a month or two on manual records, divert services, and deny claims. And if the attack results in a closure, rural communities simply can’t afford to have no emergency services.
RSS Feed
