A physiotherapy practice runs on a single software package in which records, diary and billing come together, and there is nobody in-house to take over if that package fails.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
The treatment record contains the referral, the diagnosis, the examination findings and the progress. That is health data and therefore a special category under the GDPR, alongside the professional duty of secrecy that stands apart from that law. In the event of a breach, the report to the Autoriteit Persoonsgegevens (the Dutch data protection authority) within 72 hours applies and, because the risk to those concerned is generally high where medical data is involved, so does the duty to inform the patients themselves. The number of patients is smaller than at a hospital; the weight of each record is not.
What makes a practice vulnerable is not the volume of data but the absence of spare capacity. There is no IT department, no lawyer and no communications adviser, while the diary is simply full. The incident response cover is therefore the component on which you choose this policy: a number you call, people who establish which records have been affected and who draft the notification and the patient letter while you carry on treating.
Also consider everyone who can get into the system. Locums, students on placement and self-employed professionals (zzp'ers) working with you have their own login details, and those are not always withdrawn when the arrangement ends. Insurers ask about this and attach conditions to it; answers that are not correct affect the duty of disclosure under Article 7:928 of the Dutch Civil Code and the consequences of this in Article 7:930 of the Dutch Civil Code. The same applies to the question of whether you can reach records from private devices.
What does cyber insurance for physiotherapists cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
The diary is your turnover
If the package fails, you do not know who is coming or what for. You can still treat on paper, but rescheduling appointments, reaching patients and billing afterwards becomes manual work. The interruption cover works with lost turnover; a practice's real loss often lies in the weeks afterwards, when cancelled treatments are not made up. So ask about the indemnity period and not only about the limit.
Billing runs through a chain
Claims to the health insurer run through links with external parties. If that chain stops, your income shifts back, even if your own computer is working. Check whether the policy also pays out where the cause lies with a supplier or an intermediary party and not in your own network. That is not a given, and at a practice the distinction often decides whether anything is paid out at all.
Locums' login details are a condition of cover
A practice works with changing therapists, and old accounts are often left open. That is exactly the point at which insurers include a warranty clause: multi-factor authentication, personal accounts and withdrawal of access on departure. If the investigation shows that an incident came in through an account that had not been withdrawn, the payout may be reduced. Keep a list of who has access and when it was ended.
What falls outside the cover
Not covered are administrative fines of a punitive nature, the costs of improving your systems afterwards, and damage to equipment itself, which belongs under the business contents cover. A complaint or claim about the treatment is also excluded; that belongs with your professional indemnity insurance (BAV). Intent and wilful recklessness remain excluded under Article 7:952 of the Dutch Civil Code.
What does your premium depend on?
Number of practitioners. Every therapist is an account with access to records. That helps determine the attack surface.
Size of the patient base. The number of active and archived records determines how many people you have to inform after a breach.
Working with locums and self-employed professionals. Changing access calls for account management and is expressly assessed at the acceptance stage.
Number of premises or treatment locations. Working at several locations or at patients' homes means access from outside the practice network.
Indemnity period chosen. How long the interruption cover runs matters more at a practice than the level of the limit.
Security of the practice software. Multi-factor authentication, an update policy and a tested back-up are conditions of acceptance here.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
I work on my own. Does the duty to report apply to me too?
Yes. The GDPR draws no distinction by practice size. If you process health data you are the controller, with all the duties that go with it: a record of processing activities, agreements with parties that process data for you, and in the event of a data breach the report within 72 hours. Precisely because you do it alone, access to specialists is the most important part of the policy.
My software supplier has been hacked, not me. What now?
You remain the controller for the records and report to the Autoriteit Persoonsgegevens yourself. The supplier reports the incident to you. Whether your own policy then pays out depends on whether loss caused by an incident at a service provider is included. Check that point in advance, because it is not included as standard.
Is a patient complaint about the treatment covered here?
No. Complaints about the care itself belong with your professional indemnity insurance (BAV). The cyber policy covers the consequences of a digital incident: recovery, investigation, the costs of the duty to report, your interruption and claims arising from a data breach. If a case involves both, report it on both policies.
May I view records on my own laptop or phone?
You may, but the insurer normally attaches conditions: disk encryption, a screen lock, no local copies and multi-factor authentication on access. If you state in the application that work is done only on practice equipment when that is not the case, that can count against you after an incident.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
