5 Questions Every Medical Practice Should Ask Their IT Company Before the Next Cyberattack
Your IT company may be doing a great job—but are they protecting your practice from everything that matters?
Most medical and dental practices trust their IT provider to keep computers running, software updated, and networks secure.
And many IT companies do an excellent job.
But here’s an important question:
Who is making sure your practice can survive a cyberattack—not just recover from one?
Healthcare has become one of the most targeted industries for cybercriminals. Ransomware attacks, phishing scams, and data breaches are occurring at an alarming rate, and many practice owners mistakenly believe that “having an IT company” automatically means they’re protected.
Unfortunately, that’s not always true.
Here are five questions every medical or dental practice should ask their IT provider today.
1. If We Were Hit by Ransomware Today, What’s the Exact Plan?
Most IT companies can restore computers.
The better question is whether they have a documented incident response plan.
Ask them:
- Who gets called first?
- How quickly can systems be isolated?
- Who contacts our cyber insurance carrier?
- How do we continue seeing patients?
- Who communicates with employees?
- What happens if backups fail?
If your IT company cannot clearly explain the first few hours after a cyberattack, it’s time for a deeper conversation.
2. Are Our Backups Actually Tested?
Many practices assume backups are working because someone says they are.
But backups that haven’t been tested may not restore when you need them most.
Ask:
- How often are backups tested?
- Are copies stored off-site?
- Are backups protected from ransomware?
- How long would it take to restore our practice?
The goal isn’t simply having backups.
It’s knowing they’ll work when everything else doesn’t.
3. How Are We Protecting Patient Information?
Medical practices handle some of the most valuable personal information criminals can steal.
Your IT company should be able to explain how they protect:
- Electronic Health Records (EHR)
- Patient financial information
- Insurance data
- Employee records
- Email communications
- Mobile devices
You should also ask whether your practice uses:
- Multi-factor authentication (MFA)
- Email security filtering
- Encryption
- Endpoint detection and response (EDR)
- Continuous network monitoring
Strong cybersecurity is built in layers—not a single piece of software.
4. Are We Truly HIPAA Ready?
HIPAA compliance involves much more than secure passwords.
Ask your IT provider:
- Have we completed a Security Risk Assessment?
- Are our employees receiving cybersecurity training?
- How do we monitor unauthorized access?
- How quickly can we detect a breach?
- What documentation should we maintain?
Cybersecurity and HIPAA compliance go hand in hand.
One weak link can expose your practice to regulatory penalties and expensive notification requirements.
5. What Happens If Our Cybersecurity Fails?
This may be the most important question of all.
Even the best IT companies cannot guarantee that a cyberattack will never happen.
No firewall is perfect.
No antivirus software catches everything.
No employee avoids every phishing email forever.
That’s why every practice should ask:
What financial protection do we have if our security measures fail?
The answer often includes Cyber Liability Insurance.
While your IT provider focuses on preventing attacks, cyber insurance helps your practice recover by covering many of the financial consequences that follow, including:
- Business interruption
- Digital forensic investigations
- Data recovery
- Patient notification expenses
- Credit monitoring
- Privacy attorneys
- HIPAA response costs
- Cyber extortion
- Public relations assistance
Technology helps prevent cyberattacks.
Insurance helps your practice survive them.
The two work best together.
IT Security and Cyber Insurance Are Partners—Not Competitors
Many practice owners think cybersecurity is entirely the responsibility of their IT provider.
In reality, protecting a healthcare practice requires multiple layers.
Think of it this way:
- Your IT company works to prevent cyberattacks.
- Your employees help reduce human error.
- Your cybersecurity policies improve resilience.
- Your cyber liability insurance helps your practice recover when prevention isn’t enough.
No single solution can eliminate cyber risk.
Together, they provide a far stronger defense.
Don’t Wait Until After an Attack
The best time to ask these questions is before your practice experiences a cyber incident.
A one-hour conversation with your IT provider today could uncover vulnerabilities that save your practice thousands—or even hundreds of thousands—of dollars in the future.
If your IT company welcomes these questions, that’s a good sign.
If they struggle to answer them, it’s worth taking a closer look at your overall cyber risk strategy.
Protect Your Practice Before the Unexpected Happens
At McClatchy Insurance, we work alongside medical and dental practices to help identify cyber risks and develop insurance strategies that support business continuity when the unexpected occurs.
Cybersecurity isn’t just about keeping computers online.
It’s about protecting your patients, your reputation, your revenue, and the future of your practice.
Learn more about our Medical & Dental Cyber Liability Insurance.
Explore our Medical & Dental Insurance solutions to learn how comprehensive coverage can help protect your practice.
You may also be interested in our comprehensive Medical & Dental Insurance solutions:
Frequently Asked Questions
Doesn’t our IT company already handle cybersecurity?
Most IT providers offer excellent technical support and cybersecurity services, but no technology can guarantee complete protection. Cyber liability insurance helps address the financial consequences if a cyberattack still occurs.
Is cyber liability insurance required for medical practices?
While it may not be legally required, many healthcare organizations consider it an essential part of their overall risk management strategy because of increasing cyber threats and HIPAA-related exposures.
Can cyber insurance help after a ransomware attack?
Depending on the policy, cyber liability insurance may help cover expenses such as forensic investigations, business interruption, legal services, patient notification, data restoration, and other recovery costs.
