Policyholder Services

OMIC’s e-MD™ Coverage

By Kimberly Wynkoop, OMIC Legal Counsel

Digest, Winter 2012

New liabilities are a concern when technology changes the practice environment. Now that electronic health records are becoming more prevalent, the risks they engender are also increasing.

Aside from professional liability issues, health records stored electronically are at risk of hacking, unwanted dissemination, and corruption. This can be the fault of the physician maintaining the electronic health records or of an outsider. Additionally, privacy is always a concern when personal and confidential records are maintained, whether in paper or electronic form. If medical records are computerized and security is breached, privacy violations may follow.

In response to these risks, OMIC added a new additional benefit to its professional and limited office premises liability insurance policy: e-MD™ Network Security & Privacy Coverage and Data Recovery Costs Coverage. OMIC also enhanced its Patient Notification and Credit Monitoring Costs Coverage as part of the e-MD™ program.

The e-MD™ coverage provides that OMIC will pay loss and legal expenses for claims against insureds alleging network security or privacy wrongful acts. In order to understand this coverage, it is helpful to define network security wrongful acts and privacy wrongful acts. A network security wrongful act is an act, error, or omission by an insured (including an unauthorized act by an insured’s employee) which results in an unauthorized use of the insured’s computer system that negatively affects others. Such consequences could be the failure to prevent tampering with a third party’s computer systems; the failure to prevent identity theft or credit/debit card fraud; or the inadvertent transmission of harmful or corrupt software code.

A privacy wrongful act is either of the following committed by an insured: violation of an individual’s privacy rights or violation of U.S. federal, state, or local laws associated with the control and use of personally identifiable financial or medical information (e.g., HIPAA, HITECH, and Gramm-Leach-Bliley Acts).

OMIC also provides coverage for HIPAA proceedings under the separate Broad Regulatory Protection additional benefit of the policy. Under this benefit, OMIC will reimburse the insured for legal expenses incurred as a result of a proceeding instituted against the insured by a government entity alleging violation of the Health Insurance Portability and Accountability Act (HIPAA) privacy and security regulations and fines or penalties imposed against the insured as a result of such HIPAA proceeding.

Coverage for HIPAA proceedings or privacy wrongful acts arising out of the same events is afforded under either the Broad Regulatory Protection or e-MD™ additional benefit, not both, and only one limit applies. OMIC has the sole discretion to determine which coverage provision applies.

OMIC’s updated patient notification and credit monitoring costs benefit provided under the e-MD™ program covers costs incurred as a result of a privacy wrongful act, but only if such costs are incurred with OMIC’s prior written consent. Patient notification and credit monitoring costs include all reasonable and necessary expenses incurred by an insured in notifying patients of any actual or potential privacy wrongful act. These costs could include legal expenses, computer forensic and investigation fees, public relations expenses, postage expenses, related advertising expenses, and the costs of credit monitoring services provided to affected individuals for a period of up to twelve months.

Lastly, the e-MD™ additional benefit provides that OMIC will pay the data recovery costs incurred as a result of a data interference act, but only if such costs are incurred with OMIC’s prior written consent (unless the circumstances are such that there is no opportunity to obtain OMIC’s prior written consent before incurring costs to mitigate potential damages or harm to the insured or third parties). For purposes of the additional benefit, data means any and all information stored, recorded, appearing, or present in or on the insured’s computer systems, electronic communication systems, devices, and telephony. A data interference act is any act by a party other than an insured carried out without an insured’s consent or knowledge that causes harm or damage to the data maintained by an insured. Data recovery costs are all reasonable and necessary sums incurred by an insured to recover or replace data that is compromised, damaged, or lost by reason of a data interference act, including the cost to repair or replace any software that is affected. Data recovery costs do not cover repairing or replacing any hardware, equipment, or wiring; the income of any insured; or recovering or replacing data that was not within the care, custody, or control of the insured.

In order for coverage to apply, the network security wrongful act, privacy wrongful act, or data interference act must take place on or after the insured’s retroactive date and prior to the end of the policy period.

The most OMIC will pay per insured for legal expenses, loss, patient notification and credit monitoring costs, and data recovery costs combined is $50,000 per policy period, and this is a sublimit of the $50,000 Broad Regulatory Protection additional benefit of the policy.

The above is a summary of coverage. For the full terms and conditions, please see Section VII. Additional Benefits B. and C. of your OMIC Professional and Limited Office Premises Liability Insurance policy. If you believe a network security or privacy wrongful act or data interference act has occurred, please notify OMIC at (800) 562-6642 ext. 661.