Cyber

"Covered entities" should consider using the Concentra, QCA and other resolution agreements as a road map for tightening HIPAA compliance.

Twelve characters are the absolute minimum, but passwords can be both easy to remember and hard for an attacker to crack. 

The cybersecurity framework is voluntary -- for now -- but attorneys and regulators may claim it is a de facto standard for all companies. 

No firewall is perfect, no security system impenetrable -- yet traditional insurance policies are being rewritten to exclude coverage for data breaches.

Failure to make adequate cybersecurity disclosures may subject a company to increased risk of enforcement actions and shareholder lawsuits.

Many healthcare insurers are using biometrics to help reduce billing fraud by eliminating the sharing of medical insurance cards between patients.

Selecting and negotiating the right insurance product can be a challenge because of the lack of standard language and issues with "off the shelf" policies.

Regardless of the size of the company, a data breach can be a significant threat to the survival of a company. Companies should buy a cyberliability policy to help respond to a data breach and a D&O policy to protect the management and board for their plans and decisions.