Healthcare organisations hold some of the most valuable data for cyber criminals. From patient records and payroll to medical devices and supplier systems, even a small cyber incident can disrupt care, damage reputation and result in significant financial costs.
Select the option that best describes your organisation for each question:
1. If your IT systems were unavailable for 48 hours, your organisation would:
A. Continue delivering essential services with minimal disruption
B. Experience some disruption but maintain critical services
C. Struggle to continue delivering essential services
☐ A ☐ B ☐ C
2. Your understanding of who has access to patient and business data is:
A. Fully documented and regularly reviewed
B. Mostly understood with some areas needing review
C. Unclear or not regularly reviewed
☐ A ☐ B ☐ C
3. Multi-factor authentication (MFA) is:
A. Enabled for all staff accessing email and critical systems
B. Enabled for some users or systems
C. Not widely implemented
☐ A ☐ B ☐ C
4. Your backup recovery process has been:
A. Successfully tested within the last 12 months
B. Tested previously but not within the last year
C. Never tested or unsure
☐ A ☐ B ☐ C
5. Your employees would be likely to:
A. Recognise and report phishing emails
B. Recognise some phishing attempts but benefit from further training
C. Be at significant risk of being deceived by phishing attacks
☐ A ☐ B ☐ C
6. Your cyber incident response plan is:
A. Documented and regularly practised by key staff
B. Documented but rarely or never exercised
C. Not documented or not in place
☐ A ☐ B ☐ C
7. Third-party suppliers and service providers are:
A. Regularly assessed for cyber security risks
B. Assessed occasionally or only for key suppliers
C. Not formally assessed
☐ A ☐ B ☐ C
8. Your understanding of your cyber insurance cover is:
A. Clear, including ransomware, business interruption, regulatory investigations and patient notification costs
B. Partially understood or currently under review
C. Unclear or unknown
☐ A ☐ B ☐ C
Did You Know?
The average cost of a cyber incident extends far beyond IT recovery. Organisations may also face:
• Business interruption
• Legal and regulatory costs
• Patient or customer notification expenses
• Data recovery costs
• Reputational damage
• Cyber extortion and ransomware demands
Cyber insurance can provide access to specialist incident response teams, forensic investigators, legal advisers and public relations experts, helping organisations recover more quickly when an incident occurs.
Want to know if your organisation is adequately protected?
Speak a MIAB specialist healthcare insurance adviser for a review of your cyber exposures and existing cover.