Incident response
- Reporting number outside office hours
- Forensic IT investigation
- Support with the notification to the AP
- Communication with clients and family
Electronic care records · scheduling · mobile devices
Cyber insurance for home care organisations
In home care the cyber risk lies largely outside the office: with staff members' phones and tablets and with the system that manages the routes and the records.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
Deze pagina in het Nederlands: Cyberverzekering voor thuiszorgorganisaties.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
Cyber insurance for a home care organisation consists of three parts: incident response to stop an attack and restore systems, cover for your damage to your own property such as recovery costs and loss through downtime, and liability towards clients and staff whose data has leaked. The last of these weighs heavily, because it concerns special category personal data within the meaning of the GDPR and information covered by the duty of confidentiality under Article 7:457 of the Dutch Civil Code falls.
Two things make home care different from an office organisation. First, the number of devices outside the office: every member of staff works with a phone or tablet holding the client record and the route. A device that is lost or stolen and is not encrypted or cannot be wiped remotely is immediately a data breach. Second, the dependence on scheduling and routing: if the system fails, nobody knows who is expected where and which medication has to be given.
Insurers therefore set requirements on mobile device management, on two-factor authentication and on managing the accounts of departing staff and self-employed professionals (zzp'ers) brought in. Those requirements are not advice but a condition of cover. See also the general explanation of cyber insurance.
What does the policy cover in home care?
The cover falls into three parts: help during the incident, your own loss and liability towards others.
Repair and downtime
Recovery costs and the loss for as long as scheduling and records are not working.
- Restoring data and systems
- Loss after a waiting period
- Additional costs to keep care going
- Ransomware only subject to conditions
Liability
Claims from clients and staff whose data has leaked.
- Defence against claims
- Informing data subjects
- Costs of an investigation by the AP (the Dutch data protection authority)
- Administrative fines fall outside this
What is covered
| Situation | Basic | Extended |
|---|---|---|
| Investigation and containment immediately after an attack | Yes | Yes |
| A data breach through a lost phone or tablet | Yes | Yes |
| Loss because scheduling and the care record system are down | Provided that | Yes |
| Failure at your care record or hosting supplier | No | Provided that |
| A fraudulent payment instruction after phishing | No | Provided that |
| Administrative fine from the regulator | No | No |
What is actually covered, including exclusions, limits, the waiting period and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) you receive before you take out cover.
Four points for home care organisations
Four topics that determine whether the policy actually pays out after an incident.
The risk lies in the devices in the field
Every member of staff carries a device with client data. Insurers therefore ask about encryption of the devices, about the ability to wipe a device remotely, about screen locking and about the use of private devices for work. Also make sure that accounts of departed staff and of self-employed professionals brought in are withdrawn immediately. A lost tablet without these measures almost always results in a notifiable data breach and puts cover under pressure if you previously stated something different.
In care, downtime means more than lost turnover
If the care record system or the scheduling system fails, care still has to go on. That leads to additional costs: scheduling by hand, extra staff, coordination by telephone. So look not only at the cover for lost turnover, but above all at the item for additional costs of continuing to work, at the waiting period before that cover starts and at the indemnity period. Set out in advance what records you can produce during downtime. Without evidence, the size of the loss becomes a discussion.
Reporting to the insurer and to the regulator
Report an incident as soon as reasonably possible; Article 7:941 of the Dutch Civil Code requires you to do so, and reporting late costs you cover. If you engage an IT firm yourself without consent, those costs are usually not reimbursed. The duty to report data breaches also applies: in principle a data breach must be reported within 72 hours to the Autoriteit Persoonsgegevens (the Dutch data protection authority) and, where the risk is high, to those concerned as well. Make sure staff know to whom they report a lost device within a few hours.
Autoriteit Persoonsgegevens (the Dutch data protection authority)
What cyber insurance does not cover
Outside the cover are, among other things: incidents and vulnerabilities that before the start date were already known, damage caused by software for which the supplier no longer provides support, and damage caused by acts of war or attacks by or on behalf of a state. Also administrative fines are generally not insurable under Dutch law, and failure of the power supply or the telecoms network falls outside the policy in almost every case. Errors in the care itself belong on the professional indemnity insurance (BAV). Intent and wilful recklessness are excluded under Article 7:952 of the Dutch Civil Code.
What does your premium depend on?
- Turnover: the usual basis for calculation
- Number of clients and records: size of the data collection
- Number of staff and devices: more devices, more risk
- Security level: two-factor, encryption, back-up
- Sum insured and waiting period: a higher limit means a higher premium
- Claims history: previous incidents and data breaches
Insurers weigh these details differently. That is where your saving is.
How we arrange it
- You request a quoteWe take stock of your situation, risk and wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Frequently asked questions
This is what people ask us most.
Is a lost phone with client data a data breach?
In principle yes, unless you can show that the data was unreadable, for example through encryption combined with a strong access code. If the device can be wiped remotely and that has succeeded, that limits the risk. Without those measures you have to assess the incident and in principle report it to the Autoriteit Persoonsgegevens within 72 hours.
Are self-employed professionals we bring in covered by our policy?
That depends on the description of the insured. If self-employed professionals work under your direction and on your systems, that can often be arranged, but it has to be expressly included. Also arrange for accounts to be withdrawn on departure and set out in the contract which security measures they have to take on their own equipment.
What if the failure is at our care record supplier?
That differs from policy to policy. Some insurers cover failure at an external IT service provider, others exclude it or apply a separate limit and a longer waiting period. Because a home care organisation cannot work without care records and scheduling, this is one of the most important points to check in advance and to have confirmed in writing.
Does our liability insurance not already cover this?
No. Public and employers' liability insurance (AVB) covers injury and damage to property, not the pure financial loss that arises after a data breach or systems failure. Restoring your own systems and the loss through downtime also fall outside it. Professional indemnity insurance concerns errors in the care provided. The cyber policy fills precisely the gap between them.
Is phishing that results in money being transferred covered?
Only if your policy has a module for fraud or deception in payments. That is not the case as standard. Insurers attach requirements to it on two-person authorisation and on verifying changed bank account numbers. Set that procedure out in writing and train the staff who make payments. With this cover that is often the decisive factor.
Read more
Within Cyberverzekering
Similar pages
Want to know what your cyber risk costs?
Request a quotation without obligation. We set the security requirements, the waiting period and the cover for supplier outage side by side.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was written and checked by an adviser at Finass Verzekert. Last updated on .
The information on this page is general in nature and is not personal advice.