The Call Comes on a Tuesday, and It Is Not From a Hacker

It is 7:40 in the morning. The first patient is already in room two. Your practice manager cannot get into the scheduling module, and the vendor’s status page has one gray sentence about a “service disruption.” By noon it has a different word in it: incident. By Thursday there is a letter from the vendor’s outside counsel explaining that patient records — your patient records — were accessed by someone who should not have had them. Nobody touched your network. Nobody phished your front desk. And the obligation to write to every one of those patients is still yours. That is the part practice owners in Frisco, Plano, McKinney, and Dallas find hardest to believe until it happens to them. The HHS Breach Notification Rule is direct about it: when a breach occurs at or by a business associate, the business associate notifies the covered entity — and the covered entity carries the duty to notify the individuals. Proverbs 27:12 puts the principle older than any statute: a prudent man foreseeth the evil, and hideth himself. Foreseeing this particular evil means reading a coverage part most practices have never opened. This article is educational and describes how coverage generally works; your own obligations and your own policy language should be confirmed with your attorney, your privacy officer, and your agent.

One Vendor Breach, Two Separate Losses

Strip the event down to first principles and a vendor breach is not one problem. It is two, and they are paid by two different parts of a policy.

Loss one is a privacy event. Protected health information you are responsible for was exposed. That triggers investigation, legal review, breach notification, credit monitoring, a call center, regulator correspondence, and — often — patient lawsuits. On a cyber policy this is the breach response and privacy liability side, and it is where most practices assume all cyber coverage lives.

Loss two is an operating loss. While the vendor is down you may not be able to schedule, chart, or submit claims. Revenue does not stop being earned; it stops being collected, and some of it is never recovered. That is a business income loss, and here is the distinction that decides the claim: standard cyber business interruption typically responds to an outage of your computer systems. An outage of someone else’s systems is covered — when it is covered at all — under contingent business interruption, also written as dependent business interruption. If you want the underlying mechanics of income loss coverage, we walk through them in our guide to business interruption insurance in Texas.

Two more definitional hinges sit inside that second loss. The first is whether the interruption was caused by a security failure or a system failure — someone attacked the vendor, or the vendor pushed a bad update and simply went dark. Many forms cover the first and treat the second as an optional add-on. The second is the waiting period — a number of hours the outage must run before anything is owed. It functions the way a deductible does, except it is measured in time rather than dollars, and short outages simply fall through it.

The Texas Reality: Two Clocks, Not One

Federal law sets the floor. Under the HIPAA Breach Notification Rule, a business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach, and the covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals also require notice to HHS and, in some cases, to prominent media outlets serving the area. A business associate can agree by contract to send notifications on your behalf — but under the federal rule the covered entity remains responsible for making sure the notifications happen.

Texas then runs a second clock underneath the federal one. Texas Business & Commerce Code §521.053 requires notice to affected individuals no later than the 60th day after determining a breach occurred, and separately requires electronic notice to the Texas Attorney General as soon as practicable and no later than the 30th day after that determination when the breach involves at least 250 Texas residents. That 30-day AG deadline was shortened from 60 days by Senate Bill 768, effective September 1, 2023 — a change the Texas Medical Association flagged specifically for physician practices, because it reaches breaches of electronic health records and billing information. Reported breaches are then added to a publicly accessible listing maintained by the Attorney General.

Read those two paragraphs together and the practical problem appears on its own. Your vendor may take weeks to tell you. Your 30-day state clock starts when you determine a breach occurred, and by then the forensic picture is often still incomplete. Texas HB 300 obligations and the state’s broader privacy regime sit on top of that; we cover the consumer-facing side of the state framework in our overview of the Texas Data Privacy and Security Act. None of this is legal advice, and the analysis of whether a given incident is a reportable breach belongs to counsel — but the insurance consequence is straightforward: the coverage that funds counsel, forensics, and notification needs to be in force before the vendor calls, not negotiated after.

Want this kind of breakdown as it happens? We post Texas practice-risk explainers — statute changes, endorsement shifts, and claim patterns — as soon as we see them. Like The Agent’s Office® on Facebook and they show up in your feed instead of your inbox.

Five Assumptions That Cost Practices Money

• Myth 1: “We have a signed BAA, so the vendor owns the breach.” Reality: a business associate agreement is a contract. It can allocate cost, assign the notification task, and create indemnity rights between the two companies. Under the federal rule it does not move your obligation to ensure patients are notified, and it does not fund the response.
• Myth 2: “The vendor’s cyber policy covers us.” Reality: the vendor’s policy is written to protect the vendor. Any recovery you get flows through the indemnity terms of your contract and the vendor’s willingness and ability to pay — which is why we wrote Cloud Software Won’t Cover You. In a large event, a single vendor’s limit is being divided among every downstream customer at once.
• Myth 3: “Our cyber policy has business interruption, so the outage is covered.” Reality: business interruption and contingent business interruption are different insuring agreements. Some forms include the contingent version in the base policy, some add it by endorsement, some restrict it to vendors named on a schedule, and most apply a separate sublimit and waiting period.
• Myth 4: “Regulatory fines are covered.” Reality: policies commonly cover regulatory defense costs — responding to an investigation — and may cover monetary penalties only where insurable by law, subject to sublimits. Insurability of penalties varies, and this is a question for your counsel, not a checkbox on an application.
• Myth 5: “Patients cannot sue us over a vendor’s mistake.” Reality: patients name the practice they gave their information to. The exposure is the third-party liability side of the policy, and the pattern is familiar enough that we covered it separately in Texas Small Business Data Breach Lawsuit.

What Actually Gets Paid, Line by Line

Coverage language is not standardized across the cyber market, so the table below describes how these coverage parts generally operate rather than what any particular policy will do. The only authority on your claim is your own form, endorsements, and declarations — read together. If the first-party and third-party split is unfamiliar, start with our explainer on first-party vs. third-party cyber insurance in Texas.

One more practical note on the operating loss. Even where contingent coverage exists, it is measured against what the practice would ordinarily have collected — which means clean historical financials are part of your claim preparation whether you expected that or not. Practices carrying healthcare cyber liability through a package endorsement rather than a standalone form should look particularly closely here; small embedded cyber grants are frequently limited to first-party breach response and nothing else.

How The Agent’s Office® Reads This Exposure

Most practices do not have a coverage problem they can see. They have a schedule of endorsements nobody has read since binding. So the first thing we do on a Texas medical practice insurance account is not a quote — it is a second read of the cyber form you already own, against four questions your declarations page will not answer on its own:

• Does the form include contingent or dependent business interruption at all — and is it in the base form or added by endorsement?
• Is it restricted to vendors named on a schedule? If so, is your current EHR the one listed, or the one you replaced three years ago?
• What is the waiting period, and does it differ for security failure versus system failure?
• What sublimit applies, and how does it compare to nine days of your practice’s collections?

As an independent agency representing 75+ carriers, we are not defending a single form. We can place the coverage where the terms fit the exposure, or tell you plainly that the policy you already hold is the better one — which happens more often than people expect. Our broader guide to cyber insurance for medical and dental practices in Texas covers the underwriting requirements carriers now expect, and if your practice has started using AI documentation or scribing tools, the endorsement questions get sharper still — we mapped those in Texas AI Rules for Medical Practices. Whatever your practice does, cyber sits inside the wider structure we describe on our cyber insurance page. Fully licensed, fully local, and reading the form line by line.