Data Breach

What is a Data Breach?

A data breach is the unauthorized disclosure of Personally Identifiable Information (PII). PII includes:

• Full Name
• Email Address
• Social Security Number
• Driver's License Number
• Credit Card or Debit Card Numbers
• Bank or Financial Account Number
• Client Legal Data/Records
• PII also Includes Personal Health Information (PHI), such as:
  • Medical Diagnosis
  • Patient History & Medications

It is not limited to electronic data but also includes hard copy files (i.e., paper).

Impact to Small Business Owners

In addition to potentially losing a customer's trust and their business's reputation when a data breach occurs, small business owners who lose PII can also be held responsible for the consequences of the loss. Over 44 states have regulations mandating appropriate action and time frames for notification to effected parties in the event of a data breach.

Federal regulations may also apply. For example, healthcare providers must comply with the Health Insurance Portability and Accountability Act (HIPAA), and financial institutions must comply with the Gramm-Leach-Bliley Act (GLB) requirements surrounding data security and privacy. Lack of compliance with state and federal regulations can result in severe penalties.

How Can a Data Breach Happen?

• Missing or stolen laptop or peripheral (USB flash drive)
• Mis-mailing
• Erroneous data posting in public venue
• Loss or theft of physical documents (paper)
• Computer Hacking
• Unauthorized employee disclosure

Data Breach Coverages

1st Party Breach Response Expense Coverage

This coverage is designed to pay for the expenses that an insured incurs when a breach occurs and is triggered upon the discovery of the data breach. Coverage includes:

• Notification Expenses - the cost to notify a person whose PII was subject to a breach.
• Legal and Forensic Services - expenses to provide reimbursement for the verification of compliance with data breach notification laws. Coverage is also provided for the investigation of computer hacking incidents, lost and stolen property, cyber extortion, database fraud and determinations as to whether or not data was accessed.
• Crisis Management/Public Relations Expenses - the cost to perform services by any public relations firm, crisis management firm or law firm to minimize potential harm to the insured's reputation.
• Good Faith Advertising Expenses - costs to assist in organizing the insured's media response to a breach.
• Services for individuals impacted by the data breach including credit monitoring and a help line, if warranted - includes monitoring services to provide victims with credit, fraud, public records or other monitoring alerts for up to one year.

3rd Party Defense & Liability Coverage

This coverage provides coverage for losses arising from civil awards, settlements, and judgments an insured is legally obligated to pay as the result of a data breach claim. A data breach claim is defined as a written demand for monetary or non-monetary relief based upon a data breach or a civil suit or arbitration against an insured commenced by the filing of a complaint, indictment or similar document, seeking monetary or non-monetary relief based upon the data breach.

What Types of Businesses Need This Coverage?

Any business that handles or stores private, customer, patient or employee personally identifiable information is at risk. Key industries include:

• Outpatient Healthcare
• Professional Services
  • Lawyers
  • Accountants
  • Insurance Agencies
• Retailers & Restaurants
• Financial Services