Cyber Liability for Home Health & Home Care Agencies
Home health agencies sit on huge piles of PHI — names, DOBs, diagnoses, SSNs, payer IDs. That makes them a top ransomware target. Cyber liability insurance covers the breach response, regulatory fines, and the operating losses if your EHR goes dark.
Why home health agencies are ransomware targets
Home health and home care agencies tick every box ransomware crews look for:
• Hundreds of patient records with PHI = high value on dark web • Small IT teams or outsourced IT = weaker defenses • Heavy dependence on EHR + scheduling systems = high pressure to pay quickly • HIPAA breach reporting requirements = leverage for the attacker
In 2025, healthcare suffered more reported ransomware attacks than any other sector (HHS Breach Portal). Home health specifically saw a 41% YoY increase in reported breaches.
What cyber liability actually covers
**First-party (your loss):**
• Breach response costs — forensic investigation, legal counsel, public relations • Notification costs — HIPAA-mandated notice to patients and HHS • Credit monitoring for affected patients (12–24 months typical) • Business interruption — lost revenue while your EHR is offline • Cyber extortion / ransomware payments (where legally permitted) • Data restoration costs
**Third-party (lawsuits against you):**
• Patient lawsuits alleging negligence • HIPAA regulatory fines and penalties (OCR investigations) • State attorney general actions • Payment Card Industry (PCI) fines if you take card payments
What it does NOT cover
• Pre-existing breaches discovered after the policy starts • Bodily injury (covered by your PL, not cyber) • Property damage (covered by your property policy) • Failure to maintain reasonable security controls — most policies require MFA, endpoint detection, backups • Acts of war (a 2025 exclusion most carriers added)
Typical 2026 home health cyber pricing
For an Ohio home health agency with 1,000–5,000 patient records:
• $1M / $1M cyber: $2,500 – $5,000/year • $2M / $2M cyber: $4,500 – $9,000/year • $5M / $5M cyber (for larger agencies): $9,000 – $18,000/year
Premiums depend heavily on your security posture. Carriers ask: Do you require MFA on email and EHR? Do you have a tested backup? Do you have endpoint detection and response (EDR)? Each NO can add 25%+ to premium or trigger sub-limits.
Beazley is the home health cyber leader
Beazley specializes in healthcare cyber and writes more home health/home care cyber policies than any other carrier we partner with. Their Beazley Breach Response (BBR) product includes a 24/7 breach hotline that we've seen agencies use to coordinate forensics, legal counsel, and HHS notice within hours of detection. We write Beazley cyber for Ohio, Iowa, Minnesota, and Virginia home health agencies.
Get a same-day cyber quote
Most home health cyber policies bind in 3–5 business days once we have a completed application. For agencies under 5,000 patient records and basic security controls (MFA, backups, EDR), we routinely come in under $4,000/year for a $1M policy. Call 814-718-0060 or quote at noahia.com.
Ready for a same-day quote?
Real broker. Real numbers. Same business day on most Ohio policies.