· cyber security · 4 min read
Your Cyber Insurance Renewal Is Going to Ask About AI
Renewal season is here, and the questionnaire got longer again — this time with questions about AI, encryption, and governance that most practices have never had to answer. Here are four ways to get ahead of it instead of guessing.
Your Cyber Insurance Renewal Is Going to Ask About AI
Somewhere in your inbox, or your office manager’s, is a renewal packet from your cyber insurance carrier.
Last year it asked about multifactor authentication and backups. This year it also wants to know whether your practice uses AI tools, whether staff are trained on them, whether patient data is encrypted at rest, and who governs all of it.
Most practices answer these forms the way they answer a dental history: quickly, from memory, and mostly yes.
That approach is starting to cost money, and in a claim, it can cost coverage. Here are four ways to handle this renewal on purpose.
The questionnaire got longer again
Carriers are pricing risk based on what they’ve been paying out.
Ransomware drove the multifactor and backup questions. Business email compromise drove the email-security and wire-verification questions. Now AI-assisted phishing, data leaks through consumer AI tools, and vendor breaches are driving a new section.
Expect questions like: Does your organization use generative AI tools? Is there a written policy? Is sensitive data prevented from being entered into them? Are all devices that store protected health information encrypted? Is there an inventory of vendors with access to that data?
None of those are trick questions. They’re a preview of what the carrier will check if you ever file a claim.
What they’re actually asking
Read the whole form once before anyone answers anything. Most renewal questionnaires come down to five themes:
- Access: multifactor authentication on email, remote access, and key systems
- Recovery: backups that are tested, separated from the network, and recently restored
- Devices: full-disk encryption on every laptop, tablet, and phone that holds patient data
- People: security awareness training with dates and completion records
- Governance: written policies covering acceptable use, AI, vendors, and incident response
Each “yes” on the form is a statement the carrier can verify later. Each one should map to something you can actually point to.
Answering “yes” you can’t prove
This is the expensive part.
If your practice says encryption is enabled on all devices and a lost, unencrypted laptop triggers a claim, the carrier will ask for the encryption report. If you said staff are trained on AI use and a breach traces to a pasted patient note, they’ll ask for the policy and the training record.
A misstatement on the application can reduce a payout or void the policy. That’s not a scare tactic. It’s in the fine print you signed.
The fix isn’t to answer “no” to everything. It’s to make every “yes” true and documented before the form is submitted.
Get ahead of the renewal
Ninety days out is ideal. Thirty days out is workable. The week it’s due is when practices end up guessing.
Before the form is submitted:
- Pull the actual list of devices and confirm encryption status on each one
- Confirm multifactor authentication is on, not just available, for email and remote access
- Locate your last tested backup restore and its date
- Write the one-page AI policy if it doesn’t exist, and record who has acknowledged it
- List every vendor that touches patient data and whether an agreement is on file
Anything you can’t confirm becomes a to-do with a deadline before the renewal, not a hopeful checkbox.
The form is a free audit. Treat it that way.
A cyber insurance questionnaire is one of the few times an outside party tells you exactly what a well-run practice is expected to have.
Practices that treat it as paperwork answer fast and hope. Practices that treat it as a checklist end up with lower premiums, a cleaner claim if something happens, and a security posture that’s actually stronger than it was in the spring.
The difference is a few weeks of preparation and someone willing to verify instead of assume.
We help practices work through the renewal questionnaire line by line, close the gaps that can be closed before the deadline, and produce the evidence that backs every answer. It starts with a 10-minute discovery call.
Call us at 405-253-5101 or schedule a discovery call to get on the calendar.