Here's an assumption that can cost a health tech company seven figures: "We have cyber insurance, so if we have a breach, we're covered." You might be — for a lot of it. But when the bill that arrives is a HIPAA penalty from the federal government, a standard cyber policy may leave you holding more of it than you expect.

This is one of the most misunderstood corners of health tech insurance, and it's specific to companies that touch protected health information (PHI). A cyber policy can do an excellent job on breach response and lawsuits, and still treat regulatory fines very differently — often covering the cost to defend a HIPAA investigation far more generously than the penalty at the end of it.

If your company stores, processes, or transmits PHI, this is worth understanding before a breach, not during one.

Quick answer: Many cyber liability policies include regulatory-proceedings coverage that can fund the defense of a HIPAA investigation — subject to the policy's terms, retention, exclusions, and sub-limits. Coverage for the HIPAA fines and penalties themselves is often narrower: sub-limited, conditioned, or excluded unless regulatory penalties are affirmatively covered by the form or an endorsement. Even then, fines are only payable "where insurable by law," which varies by jurisdiction and by the nature of the violation. Health tech founders should confirm what their declarations page and endorsements actually say — before an incident.

‍

Let's unpack what that actually means.

Why "we have cyber insurance" isn't the whole answer

A modern cyber policy is genuinely valuable, and for a health tech company it typically handles the core of a breach well: forensic investigation, patient notification, credit monitoring, ransomware response, business interruption, and lawsuits from affected individuals.

The gap tends to sit in one specific place — regulatory fines and penalties. When the U.S. Department of Health and Human Services, through its Office for Civil Rights (HHS/OCR), pursues a HIPAA action, there are really two costs: the defense of the investigation, and the penalty if one is assessed. Cyber policies generally treat those two very differently.

Where a cyber policy includes regulatory-proceedings coverage, it often covers defense costs more broadly than it covers civil penalties — but the retention, the limit, the exclusions, and the policy's definition of a covered regulatory action all still matter. That asymmetry is exactly where founders get surprised.

In other words, coverage for a breach and coverage for a HIPAA fine are not the same statement. A well-structured cyber policy can address many breach-response costs, but the specific insuring agreements, exclusions, retention, and limits still control — and the fine is the part most likely to fall short.

Are HIPAA fines covered by cyber insurance for health tech?

Sometimes — and the conditions matter. Here's the honest, precise version.

Coverage for HIPAA penalties usually depends on two things stacking up in your favor:

• The policy has to actually grant it. Regulatory defense and penalties may be built into the base cyber form, provided by endorsement, or capped by a separate sub-limit — it varies by insurer. The declarations page and the endorsement schedule, not the policy label, tell you what is actually covered.
• The fine has to be insurable in the first place. Whether a HIPAA civil monetary penalty is insurable is a legal and policy-specific question. Many cyber forms cover civil fines or penalties only "where insurable by law," and the result can depend on the jurisdiction imposing the penalty, the nature of the violation, and the wording of the policy — not simply on the HIPAA tier.

So the accurate framing isn't "cyber never covers HIPAA fines" or "cyber always does." It's: coverage may exist, but only where the form or an endorsement affirmatively provides it, and only where the fine is insurable under the applicable law. For a health tech founder, that means the question to ask isn't just "do we have cyber?" — it's "does our policy affirmatively cover regulatory penalties, and what's the sub-limit?"

What HIPAA fines actually look like

It helps to see the numbers, because they're the reason this matters. HIPAA civil monetary penalties are tiered by culpability and adjusted for inflation. The following figures reflect 2026 published amounts; confirm current figures with HHS/OCR or counsel, because they change over time.

‍

Two things stand out. First, penalties are assessed per violation, and a single breach can involve many violations, which is how totals climb fast. Second, the tiers where fines are largest — willful neglect — are also the tiers where insurability gets hardest. That's not a coincidence, and it's a reason your regulatory coverage and your compliance posture both matter.

For context on the stakes, healthcare has consistently ranked among the costliest industries for data breaches, and HHS/OCR enforcement remains active, with inadequate security risk analysis continuing to appear in enforcement actions. The penalty is often not even the biggest line item in a breach — but it's the one people most wrongly assume is automatically covered.

What a health tech cyber policy should actually include

Beyond the HIPAA-penalty question, a cyber program built for a company handling PHI usually needs more than an off-the-shelf tech policy. The pieces worth confirming:

‍

The single most important line for this article is the third one. A health tech founder should specifically confirm that regulatory fines and penalties are affirmatively covered — whether in the base form or by endorsement — and ask what the sub-limit is, since HIPAA exposure can be large relative to a token cap.

Cyber liability insurance for health tech companies storing PHI

If your product stores, processes, or transmits PHI, you're squarely in scope — and often in ways founders underestimate.

You may be a covered entity or, very commonly for health tech, a business associate handling PHI on behalf of providers, health plans, or other companies. Either way, a breach can trigger HIPAA exposure, and your customer contracts (business associate agreements) frequently push liability and insurance requirements onto you directly. It's not unusual for a hospital or payer client to require specific cyber limits and HIPAA-related coverage before they'll sign.

That's the practical reason this coverage isn't optional for PHI-handling companies: it's both a real risk-management need and something your enterprise healthcare customers may contractually require. A cyber liability policy scoped for PHI — with regulatory defense and penalties addressed in the base form or by endorsement — is what helps satisfy both.

Insurance for telehealth and digital health companies

Telehealth and digital health add exposures that a plain cyber policy wasn't necessarily designed for, and they often sit at the seam between cyber and professional liability.

A few worth flagging:

• Telemedicine liability — when care is delivered through your platform, a bad outcome can raise professional-liability questions, not just data questions. That's often professional liability / E&O or medical malpractice territory, alongside cyber.
• Medical device and connected-hardware cyber — if your product includes or integrates devices, their security is part of your exposure.
• ‍EHR / platform failure — an outage or failure in a system clinicians rely on can cause harm and claims beyond a simple data breach.
• Business associate obligations — the contractual and regulatory duties that come with handling PHI for others.

For digital health companies, the takeaway is that "cyber insurance" alone rarely tells the whole story. The right program usually coordinates cyber with professional liability and, depending on the model, other coverages — so a claim doesn't fall into the gap between them. Fullsteam works with health, wellness, and life sciences companies on exactly this kind of layered program.

What to ask for before a breach

You don't want to be reading your policy for the first time during an HHS/OCR investigation. Ahead of any incident, confirm the following — ideally with your broker:

• Are regulatory defense costs and civil penalties affirmatively covered — in the base form or by endorsement? Defense alone isn't enough; ask specifically about the penalties piece.
• ‍What is the sub-limit on regulatory fines? A token sub-limit against a multi-million-dollar exposure isn't real protection.
• Does the policy cover fines "where insurable by law," and what does that mean in your state? Your broker can help you understand the jurisdictional reality.
• Are business associate liabilities and your BAA requirements covered? Match the policy to what your customer contracts actually demand.
• ‍Are telehealth, medical device, and professional-liability exposures addressed — in the cyber policy or a coordinated one?
• Do the limits meet what your healthcare clients require? Enterprise customers often specify minimums.
• Ask for the actual endorsement schedule and definitions — not just a certificate or a coverage summary. The specific wording, the facts of the incident, and applicable law determine whether and how a claim is covered.

If you can't answer these confidently, that's the signal to have someone review the program before you need it.

The bottom line

Cyber insurance is a core risk-management consideration for companies handling health data — but for health tech specifically, the coverage that matters most is also the easiest to overlook. A standard cyber policy will often defend a HIPAA investigation while covering the penalty itself only partially, conditionally, or not at all — unless regulatory penalties are affirmatively covered in the base form or by endorsement, and only where those fines are insurable by law.

The good news is that these gaps can often be identified and addressed before an incident — if you review the policy form, endorsements, and sub-limits early. Confirm how regulatory penalties are treated, check the sub-limit, and make sure your cyber, professional-liability, and regulatory coverage are working together. Do that, and your company is far better positioned to manage the financial and operational fallout of a breach.

‍

Not sure whether your policy would actually cover a HIPAA fine? Send over your current cyber policy, and a Fullsteam advisor familiar with health-tech and digital-health coverage will walk through where your regulatory, PHI, and telehealth coverage stands — and what to consider before you need it.

Talk to a Fullsteam advisor about your health tech coverage

‍

Frequently Asked Questions

Does cyber insurance cover HIPAA fines for health tech companies?

‍
Sometimes, but not automatically. Where a cyber policy includes regulatory-proceedings coverage, it often funds the defense of a HIPAA action more broadly than it covers the penalty itself. Coverage for the fine depends on whether regulatory penalties are affirmatively covered — in the base form or by endorsement — is often sub-limited, and only applies where the fine is insurable under the applicable law. Health tech founders should confirm how their policy treats regulatory penalties, and check the sub-limit, before a breach.

What does health tech HIPAA breach insurance actually cover?

‍
A cyber policy built for health tech typically covers breach response (forensics, patient notification, credit monitoring), regulatory defense costs, third-party patient lawsuits, ransomware and extortion, and business interruption. Coverage for HIPAA penalties themselves depends on whether the policy or an endorsement affirmatively covers them, the applicable sub-limit, and state-law insurability rules. Telehealth, medical device, and professional-liability exposures often need coordinated coverage beyond cyber alone.

Are HIPAA penalties even insurable?

‍
Whether a HIPAA civil monetary penalty is insurable is a legal and policy-specific question. Many cyber forms cover civil fines or penalties only "where insurable by law," and the answer can depend on the jurisdiction imposing the penalty, the nature of the violation, and the wording of the policy. It's a genuine legal limitation, so it's worth confirming with your broker and, where relevant, counsel — not assuming.

What cyber insurance do telehealth and digital health companies need?

‍
Telehealth and digital health companies usually need a cyber policy scoped for PHI, plus coordinated professional liability / E&O or medical malpractice coverage for care delivered through the platform. Medical device cyber exposure, EHR or platform failure, and business associate obligations should also be addressed. The goal is a program where cyber and professional coverage work together rather than leaving a gap.

Do health tech companies storing PHI legally need cyber insurance?

‍
HIPAA doesn't explicitly require cyber insurance, but the HIPAA Security Rule requires covered entities and business associates to manage risk, and a breach without coverage can be extremely expensive. In practice, many enterprise healthcare customers also require specific cyber and HIPAA-related coverage in their business associate agreements, so for most PHI-handling companies it's effectively necessary.

‍