Incident response
- Reporting number outside office hours
- Forensic IT investigation
- Support with the notification to the AP
- Communication with patients
GP system failure · medical data breach · incident response
Cyber insurance for GPs
A GP practice cannot deliver care without its information system and, on top of that, manages the most sensitive category of personal data there is. That makes the cyber risk different from that at an average business.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
Deze pagina in het Nederlands: Cyberverzekering voor huisartsen.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
Cyber insurance for a GP practice comes down to three things. The emphasis lies on incident response: a reporting number you can reach outside office hours, forensic investigation, help with recovery and legal assistance after a data breach. The policy also covers your damage to your own property, such as restoring systems and the loss of turnover through downtime, and the liability towards patients whose data has leaked.
What makes the practice special is the nature of the data. A medical record contains special category personal data within the meaning of the GDPR, and the care provider is also under a duty of confidentiality under Article 7:457 of the Dutch Civil Code. A breach therefore affects not only patients' privacy but also your professional secrecy. Insurers assess care providers more strictly for that reason and their questionnaires often refer to the standards for information security in healthcare, such as NEN 7510.
The second feature is the dependence on a single system. If the GP information system is down, you cannot view a record, send a prescription or make a referral. That failure often lies not in your own network but with the supplier. So check whether failure at an external service provider is included. See also the general explanation of cyber insurance.
What does cyber insurance cover for a practice?
The cover falls into help during the incident, your own loss and liability towards patients.
Repair and downtime
Restoring records and systems and the loss for as long as you can only work in a limited way.
- Restoring data and systems
- Loss of turnover after a waiting period
- Additional costs to keep working
- Ransomware only subject to conditions
Liability
Claims and costs where medical data has leaked from your practice.
- Defence against claims
- Informing data subjects
- Costs of an investigation by the AP (the Dutch data protection authority)
- Administrative fines fall outside this
What is covered
| Situation | Basic | Extended |
|---|---|---|
| Investigation and containment immediately after an attack | Yes | Yes |
| Restoring records, systems and workstations | Yes | Yes |
| Loss of turnover because the practice is at a standstill | Provided that | Yes |
| Failure at your GP system supplier or hosting provider | No | Provided that |
| A claim from a patient after a data breach | Provided that | Yes |
| Administrative fine from the regulator | No | No |
What is actually covered, including exclusions, limits, the waiting period and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) you receive before you take out cover.
Four points for GP practices
Four topics that determine whether the policy actually pays out after an incident.
The security questionnaire becomes part of the policy
Insurers ask about two-factor authentication on email and on access from outside, about back-ups that are kept separate from the network and are restored periodically, about keeping software up to date and about managing the accounts of staff who have left. What you enter falls under the duty of disclosure under Article 7:928 of the Dutch Civil Code. If the picture does not match at the time of a claim, the insurer can reduce or refuse the payout under Article 7:930 of the Dutch Civil Code. Go through the list with your IT manager and record the answers.
Your biggest dependence lies outside your door
The GP system, the hosting, the patient portal and the telephony usually run at external parties. If something fails there, the practice comes to a standstill without anything being wrong in your own network. Not every policy covers that. Look at the description of failure at an external IT service provider, at any separate limit and at a longer waiting period for this component. Also put a data processing agreement and arrangements about recovery in place with your supplier. That matters both for the insurance and in practice.
Reporting: to the insurer and to the regulator
Report an incident as soon as reasonably possible; Article 7:941 of the Dutch Civil Code requires you to do so, and reporting late costs you cover. If you engage an IT firm yourself without consent, those costs are usually not reimbursed. The duty to report data breaches also applies: in principle a data breach must be reported within 72 hours to the Autoriteit Persoonsgegevens (the Dutch data protection authority), and where the risk is high to the patients concerned as well. The incident response service helps you meet that deadline and draw up the report carefully.
Autoriteit Persoonsgegevens (the Dutch data protection authority)
What cyber insurance does not cover
Outside the cover are, among other things: incidents and vulnerabilities that before the start date were already known, damage caused by software for which the supplier no longer provides support, and damage caused by acts of war or attacks by or on behalf of a state. Also administrative fines are generally not insurable under Dutch law, and failure of the power supply or the telecoms network falls outside the policy in almost every case. A disciplinary complaint or a medical professional error belongs on the professional indemnity insurance (BAV). Intent and wilful recklessness are excluded under Article 7:952 of the Dutch Civil Code.
What does your premium depend on?
- Turnover of the practice: the usual basis for calculation
- Number of registered patients: size of the data collection
- Dependence on the GP system: how quickly the practice comes to a standstill
- Security level: two-factor authentication, back-ups, patching policy
- Sum insured and waiting period: a higher limit means a higher premium
- Claims history: previous incidents and data breaches
Insurers weigh these details differently. That is where your saving is.
How we arrange it
- You request a quoteWe take stock of your situation, risk and wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Frequently asked questions
This is what people ask us most.
Does my professional indemnity insurance not already cover this?
No. Medical professional indemnity insurance concerns errors in the care provided. A break-in in your network, a leaked record or the restoration of failed systems falls outside it, as does loss of turnover through downtime. Cyber insurance fills precisely that gap. Both policies may be needed alongside each other, with a clear boundary between clinical errors and IT incidents.
What if the failure is at my GP system supplier?
That differs greatly from policy to policy. Some insurers cover failure at an external IT service provider, others exclude it or apply a lower limit and a longer waiting period. Because a GP practice runs almost entirely on one system, this is the most important point to check before taking out cover and to have confirmed in writing.
Is a GDPR fine insured?
Administrative fines are generally not insurable under Dutch law. What is usually reimbursed are the costs of legal assistance during an investigation by the Autoriteit Persoonsgegevens, informing patients, and the loss patients recover from you themselves. Ask expressly how your policy describes the costs around such an investigation.
Is a ransom paid after a ransomware attack reimbursed?
Sometimes, and always subject to conditions. The insurer must give consent in advance and it is assessed whether payment is legally permitted and whether there is an alternative. If you pay on your own initiative, the reimbursement usually lapses. In practice, restoring records and the standstill of the practice matter more than the ransom item itself.
What must I have in place internally before taking out cover?
At a minimum: two-factor authentication on email and remote access, back-ups outside the network that you restore periodically, software kept up to date, and a procedure for setting up and closing down staff accounts. Also record who calls in the event of an incident and which number is used. Insurers check these points and use your answers later when assessing a claim.
Read more
Within Cyberverzekering
Similar pages
- Cyber insurance for your business
- Cyber insurance for home care organisations
- Cyber insurance on the rise: what has changed
- Compare business cyber insurance
- Cyber insurance through Chubb
- Cyber insurance for self-employed professionals
- Cyber insurance through Allianz
- Cyber insurance in 2025: from option to necessity
Want to know what your practice risk costs?
Request a quotation without obligation. We set the security requirements, the waiting period and the cover for supplier outage side by side.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was written and checked by an adviser at Finass Verzekert. Last updated on .
The information on this page is general in nature and is not personal advice.