Commercial Insurance Blog

The loss of proprietary or confidential customer data is a bad scenario even on a good day. Consider the "missing" data from South Shore Hospital's archived records in 2010. The hospital had entrusted data to an outside firm and that company’s inability to confirm its receipt and destruction created a huge headache and PR nightmare for the hospital.  

South Shore Hospital showed admirable transparency and openness in their handling of the matter. Their proactive handling was a model of how to minimize the PR effects of this kind of incident.

Maintaining established procedures for data security and data destruction is required by every business that holds confidential customer information. It’s the law here in Massachusetts, known as CMR-17. But even with the best procedures and most vigilant attention, surprises can happen. Data is transmitted across multiple platforms and even the best information security plan won't necessarily prevent an accidental loss in ways we can't even imagine.

Damages in the form of penalties under Massachusetts CMR-17 regs are bad enough:  $5,000 per record, making a 1000 record loss a potentially $5,000,000 fine! That's before your customers start hiring attorneys, or the cost of network engineers to begin their forensic analysis, or paying for customers to join "lifelock" or similar protective services. 

Fortunately there is insurance available today that includes coverage NOT ONLY for damages, but also the cost of crisis management expenses, the notification of affected parties, credit monitoring costs, forensic costs and a variety of other expenses incurred after a data breach. One thing we do know is if a breach happens, it will cost way more than any actual damages to your customers. Because of the potential size and scope of data breaches, insurance can be an effective solution to this risk.

For controlling this risk and advice on data security in general and in particular, look to Gordon Atlantic for cyber liability and other business risk solutions, including our dedicated page with more information and applications.