The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
A dental practice is more digital than most healthcare practices. The patient record, the digital X-ray and CBCT images, the intraoral scanner, the appointment diary and the flow of claims to the health insurer all hang on the same network. If that fails, you cannot fall back on paper: images cannot be reconstructed without exposing the patient to another scan.
The loss is therefore twofold. There is the standstill of a practice with fixed staffing and a full diary, which you lose day by day, and there is the loss of records that the WGBO (the Dutch act on the medical treatment contract) requires you to be able to produce for a long period. On top of that comes the duty to report a breach: dental data is health data and therefore a special category of personal data.
For practices where treatment notes and confidentiality weigh more heavily than equipment, the emphasis lies differently; see the version for psychologists or the physiotherapist.
What does cyber insurance for dental practices cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Images are the most vulnerable layer of your archive
X-rays and scans often sit on a separate image server that gets less attention than the practice management package. In a ransomware attack that is the folder that is missed most and that nobody can retype from a printout. Check whether your back-up actually includes the image storage and whether you have ever restored it. Data recovery and reconstruction are a core part of cyber cover, but no policy can bring back what is gone for good.
Downtime here costs a full diary, not deferred hours
A consultancy makes up lost hours later. A dental practice does not, because the chairs and the team are fixed in a rota. A day of downtime is a day of turnover that does not come back, while the wage costs keep running. So look closely at the waiting period in the business interruption cover: below that threshold nothing is paid, and many outages last exactly that long. Also ask about cover for additional costs to get back to treating patients sooner.
Damage to equipment does not fall under the cyber policy
If the treatment unit, the image sensor or the server is physically broken, that is a matter for your business contents or electronics insurance, even where software is involved. The cyber policy pays for no hardware, no damage from power failure and no faults that do not arise from a security incident. An outage of your internet connection or of a supplier is also usually covered only if you included that extension, with its own waiting period.
Reporting has to happen faster than you think
Where health data leaks, the 72-hour period for reporting to the Autoriteit Persoonsgegevens (the Dutch data protection authority) runs and you often have to inform patients as well. Towards the insurer, Article 7:941 of the Dutch Civil Code applies: report as soon as you know of it. Do not wait until you know the extent, because log files disappear quickly. What the policy does not solve: a administrative fine is not insurable and neither are disciplinary consequences. What is covered is the investigation, the notification costs and claims from patients.
What does your premium depend on?
Size of the image archive. Years of X-rays and CBCT scans determine the volume to be restored and the number of people affected by a breach.
Number of surgeries and daily turnover. The business interruption loss per day of downtime is directly tied to the occupancy of the chairs and the rota.
Back-up of image and record data. Insurers ask whether the image server is in the back-up and whether restoring it has demonstrably been tested.
Links with external systems. Claims traffic, referrals to an oral surgeon and dental laboratories are further connections to the outside.
Age of the software on equipment. Treatment equipment on an outdated operating system that is no longer updated raises the risk noticeably.
Access control per member of staff. Personal accounts with two-factor authentication instead of one shared login at reception.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Our practice package runs at a supplier. Is cyber insurance still needed?
Yes. The supplier secures his own environment, but your practice remains the controller for the patient data and bears the interruption loss itself if his service fails. An attacker, moreover, usually gets in through a stolen login belonging to the practice, not through the supplier. Check whether your policy includes failure at a service provider and what waiting period applies to it.
Does the policy pay for retaking lost X-rays?
The costs of data recovery and reconstruction are covered, but an image that has gone for good can only be taken again. That means additional radiation exposure for the patient and time you do not charge for. That is precisely why a tested back-up of the image archive weighs more heavily at dental practices than in almost any other sector; insurers ask about it expressly.
Our server broke down in a power cut. Is that a cyber loss?
No. Physical damage to equipment and the consequences of a power failure fall under business contents or electronics insurance, not under the cyber policy. That starts with a security incident, such as ransomware, a break-in or a data breach. When advising, we look at both policies together, so that faults, fire and cyber incidents each end up with the right cover and nothing falls between them.
Do we have to inform patients after a data breach?
Often, yes. Where health data is involved the risk to those concerned is generally high, and then the GDPR requires you to inform the patient as well as reporting to the regulator. The costs of that process, including legal review and communication, fall under the notification costs cover. The condition is that you reported the incident to the insurer in good time, so that their specialists can guide the notification.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
