Cyber Liability Insurance for Dental Practices: What Carriers Actually Ask

Cyber insurance is one of those subjects every practice owner nods along to and almost nobody reads closely.

Two carriers sell cyber coverage to dental practices for the same ransomware risk. Travelers hands the applicant a separate signed form that breaks multi-factor authentication into four different systems, down to who can log into the backup console, and asks the signer to confirm the person who runs their IT helped answer it. TDIC, one of the best-known dental-endorsed carriers in the country, publishes a five-question application, in a version dating to March 2020, that never mentions multi-factor authentication at all. Same risk, same industry, very different questions.

That gap matters because cyber liability insurance for a dental practice is priced and issued off that application, a document that rarely gets a close read. Accurate answers keep your own statements from becoming the problem later. Answering them quickly and from memory is how a practice ends up holding coverage a carrier can try to unwind after a breach.

We are an IT company, not an insurance agency. We do not sell policies and we do not get paid when you buy one. We end up involved because the security questions on these forms are questions about the environment, and that is the part a practice cannot answer reliably without its IT provider. So we read the applications themselves rather than the articles about them. The table below lays out what each one asks, control by control, and what changes when one signature answers for a multi-location group, down to which practice entities the policy actually covers.

What Cyber Insurance Applications Ask, Control by Control

Cyber insurance applications for dental practices ask about the same core controls, from multi-factor authentication and backups to vendor access and which legal entities a policy covers, but no two published forms ask about them the same way. The table summarizes the main questions on each form and cites each by number and edition where it prints them, because carriers revise these documents.

The forms: Travelers’ CyberRisk Application (CYB-14102 Ed. 01-19), Multi-Factor Authentication Supplement (CYB-14306 Rev. 03-23) and Healthcare & Managed Care Supplement (CYB-14303 Ed. 01-19), the Corvus Smart Cyber application (Version 3.2, September 2024, which prints no form number), Beazley’s application for applicants under $250 million in revenue (F00863, 042023 ed.) and TDIC’s Cyber Suite application (CYB9016-0320AS, with no separate edition printed).

What cyber insurance applications ask, by control, cited by form number and edition

Control	What the application asks	Why it matters at multi-location scale
Multi-factor authentication	Travelers CYB-14102 Ed. 01-19: MFA for admin or privileged, remote network and remote email access. Travelers CYB-14306 Rev. 03-23: web email, remote access, and admin access to directory services, backup environments, network gear and endpoints, including by 3rd party providers. Corvus Version 3.2: remote, privileged, email and critical-application access. Beazley F00863 (042023 ed.): remote access and web email.	One yes speaks for every office in the application, and Travelers extends it to admin access by outside service providers. A backup console or firewall set up per office before an acquisition, and never brought under the group standard, can make that yes inaccurate.
Backups	Corvus Version 3.2: frequency plus eight backup characteristics to select, including offline or air-gapped copies, immutable backups and MFA on backups. Travelers CYB-14102 Ed. 01-19: automated, and tested annually. Beazley F00863 (042023 ed.): at least monthly, or at least weekly or daily.	Each box you select describes the group’s backups. A group with immutable, MFA-protected backups at eighteen practices and a local drive at the nineteenth has to disclose the nineteenth.
Endpoint protection and EDR	Travelers CYB-14102 Ed. 01-19: antivirus only. Corvus Version 3.2: next-gen antivirus, EDR, MDR or XDR, with product and vendor. Beazley F00863 (042023 ed.): endpoint protection for everyone, plus EPP, EDR and MDR vendor names for applicants over $35 million in revenue. TDIC CYB9016-0320AS: "virus protection" inside one general security question, at the $250,000 limit.	If acquired sites run a different tool, name it or disclose the exception. A growing group can also cross Beazley’s $35 million line and start answering the extra questions on the same form.
Patching	Travelers CYB-14102 Ed. 01-19: a patch process, whether it is automated, and critical patches within 30 days of release. Beazley F00863 (042023 ed.): whether you or an outsourced provider manage critical patches on internet-facing systems. Corvus does not ask.	A 30-day window has to hold at every location, including practices still running the previous owner’s machines.
Incident response and recovery plans	Travelers CYB-14102 Ed. 01-19: a recovery or continuity plan and an incident response plan, whether both are tested, and restore time (unknown, 0 to 12 hours, 12 to 24, over 24). Corvus Version 3.2: a continuity or recovery plan tested in the last 12 months. Beazley F00863 (042023 ed.): an incident response plan, asked only above $35 million in revenue.	Travelers asks how long restoring critical operations takes, based on testing, so the test has to include the locations those operations depend on. My default is a plan that names who acts at each office.
Vendor and third-party risk	Travelers CYB-14102 Ed. 01-19: vendor security policies, review, revocation and logging of vendor access, vendor insurance and indemnity clauses. Travelers CYB-14303 Ed. 01-19: a BAA with indemnity language, and whether you verify vendors’ controls.	Each acquired practice brings its own vendors, remote-access tools and BAAs, so the group may be attesting to contracts it has never reviewed.
HIPAA and PHI	Travelers CYB-14102 Ed. 01-19, question 4: healthcare provider, business associate or covered entity, then "is the Applicant HIPAA compliant?" Travelers CYB-14303 Ed. 01-19: full or partial compliance, PHI encryption in five settings including employee-owned devices, and annual HIPAA audits or assessments. Corvus and Beazley do not ask.	A "full" answer rests on a Security Risk Analysis covering every location’s systems, including practices added since it was written.
Security awareness training	Travelers CYB-14102 Ed. 01-19: annual security training. Corvus Version 3.2: training for all employees at least annually. Beazley F00863 (042023 ed.): never, annually, or twice or more a year, plus anti-fraud training for staff who send payments.	"All employees" includes the front desk and billing team at every office, and staff who arrived with this year’s acquisitions.
Prior incidents	Every main application asks: Travelers CYB-14102 Ed. 01-19 and Corvus Version 3.2 over three years, Beazley F00863 (042023 ed.) over five, TDIC CYB9016-0320AS over 12 months for a breach of personal information, at the $100,000 and $250,000 limits. Travelers also asks whether "the Applicant, any Subsidiary, or any person proposed for this insurance" knows of a circumstance that could lead to a claim.	Collect incident history from each acquired practice before renewal. An incident one office handled quietly can become the group’s misstatement once the group knows about it.
Acquisitions and covered entities	Beazley F00863 (042023 ed.), question 22: any merger, acquisition or consolidation completed or agreed in the past 12 months. Travelers CYB-14102 and CYB-14303 (Ed. 01-19): affiliates other than defined Subsidiaries "are not covered unless the Insurer has agreed specifically to schedule such entities by endorsement." Corvus Version 3.2: subsidiaries and an organization chart. No form asks how many locations you have.	If practices sit in separate legal entities, confirm each one is a named insured or, under the Travelers wording, a qualifying Subsidiary or a scheduled affiliate. Otherwise it may sit outside the coverage the group thinks it bought.
Reporting changes after you sign	Travelers CYB-14102, CYB-14303 (Ed. 01-19) and CYB-14306 (Rev. 03-23): notify Travelers of "any material changes," with no end date stated. TDIC CYB9016-0320AS: any change "before and after a policy is issued." Beazley F00863 (042023 ed.): only until the effective date. Corvus: no such clause.	Every acquisition, PMS migration or change of IT provider can alter what you attested, and the Travelers wording states no end date, so confirm with your broker how long the duty runs.

TDIC’s application shows up in only three rows, and its five yes/no questions get their own section below. Where a form is missing from a row, check the form itself before assuming the carrier does not ask, and expect supplements or a broker conversation to add questions.

The Application and the Policy Do Different Jobs

Most coverage explainers stop at what a policy pays for: breach response, forensics, data restoration, business interruption, ransomware and extortion, and third-party liability.

Two other questions get far less attention, and they are separate. What has to be true about your practice for a carrier to issue coverage in the first place, and what the policy itself grants, limits and excludes once issued. The application governs the first. The policy form governs the second. Getting the application right does not guarantee any particular claim gets paid, because exclusions, conditions, sublimits and retentions all live in the policy. An accurate application protects something narrower: the contract itself, against a claim that you misstated the facts.

Start with what the application itself says it is for. On a Travelers CyberRisk application, the language above the signature line reads:

"The undersigned Authorized Representative represents that to the best of his or her knowledge and belief, and after reasonable inquiry, the statements provided in response to this Application are true and complete, and, except in NC, may be relied upon by Travelers as the basis for providing insurance."

Read the phrase "after reasonable inquiry" again. It is doing real work. The representation is your knowledge and belief, formed after you have checked.

Then read what the policy can do with those answers afterward. The National Association of Insurance Commissioners, the standards body for state insurance regulators, put it plainly in the exclusions section of its 2023 report on the cybersecurity insurance market:

"Failure to maintain security measures is another common exclusion to cyber insurance policies. An insurance policy’s terms may require an insured to maintain appropriate procedures and controls to protect against cyberattacks. For example, insurers may require an insured to use two-factor authentication and patch its computer systems in an acceptable timeframe."

So the controls can matter twice, through two different mechanisms. Once as representations when you attest to them to obtain the policy, and separately as policy conditions where a carrier has written maintenance of those controls into the coverage form. Those are not the same instrument and not every carrier uses both.

Three Questions That Need More Than a Checkbox

Three questions on these forms deserve more care than a dental practice usually gives them: which systems multi-factor authentication covers, who helped answer the form, and whether you are HIPAA compliant.

1. Multi-factor authentication, broken into four separate systems

This is the question that catches dental practices, because "we have MFA" is almost never a single fact. Travelers uses a standalone multi-factor authentication form that an applicant signs separately from the application, currently published as the Multi-Factor Authentication Supplement, form CYB-14306 Rev. 03-23. It asks whether MFA is required for email and for remote network access, and then it asks this:

"In addition to remote access, multi-factor authentication is required for the following, including such access provided to 3rd party service providers: a. All internal & remote admin access to directory services (active directory, LDAP, etc.). b. All internal & remote admin access to network backup environments. c. All internal & remote admin access to network infrastructure (firewalls, routers, switches, etc.). d. All internal & remote admin access to the organization’s endpoints/servers."

Item b is the one worth stopping on. A practice can have MFA on Microsoft 365, on the VPN, and on the PMS, and still have a backup console that an administrator reaches with a username and a password. Travelers explains on the same form why it cares: requiring MFA on administrative access "can prevent an intruder from gaining the level of access necessary to successfully deploy ransomware across the network."

These forms also get revised. The edition filed as an exhibit in the 2022 case discussed below, CYB-14306 Ed. 05-21, was titled an Attestation and told applicants outright that the listed controls "are the minimum controls that must be in place in order to be eligible for a Cyber policy." The current Rev. 03-23 is titled a Supplement and does not carry that sentence. The four-part question above appears in both.

2. Whether you consulted the person who runs your security

The last item on that same Travelers form is not a technical question at all:

"The signer of this form has done so with the assistance of the person in charge of IT security."

A practice owner who signs that after filling the form out alone has made a representation about process, not just about technology. The Ed. 05-21 edition said it outright, instructing outsourced practices to complete the form with their managed security provider. Rev. 03-23 simply asks, yes or no, whether that help happened. My recommendation is the same either way: get it.

If you take one operational thing from this article, take this: get your IT provider’s help before you answer a cyber application. The form asks you to say whether you did.

3. HIPAA compliance, compressed into one question

This is where dentistry differs from a general small business, and it deserves more thought than it usually gets.

The Travelers CyberRisk application asks, at question 4, whether the applicant is "a Healthcare Provider, Business Associate, or Covered Entity under HIPAA," and if yes, follows immediately with one question: "is the Applicant HIPAA compliant?" Travelers’ healthcare supplement, CYB-14303 Ed. 01-19, goes further and asks whether you are in full or partial compliance.

Practically every dental practice that bills electronically answers yes to the first half. The second half is then a single yes/no covering all of HIPAA.

"Are you HIPAA compliant?" feels like a question with an obvious answer. It is not. HIPAA compliance is not a status you hold, it is a set of documented practices, and the anchor of it is a Security Risk Analysis. HHS requires the risk analysis be conducted and reviewed periodically, and does not prescribe a frequency. Annual review is what we recommend, but the more useful question before you answer a carrier is simpler: can you produce the document at all, and does it reflect the systems you are running today? If nobody in the practice can find one, raise that with your broker before you answer the insurance question.

We wrote a separate 20-item IT audit for dental practices that covers what a defensible security posture looks like control by control. This article is about what happens when you tell an insurance carrier you have one.

What the Dental-Endorsed Carrier Asks Instead

Dental-endorsed programs underwrite differently, and TDIC’s form is worth reading on its own rather than only as the form missing from most rows of that table.

The Dentists Insurance Company, TDIC, is one of the best-known dental-endorsed carriers in the country, and to its credit it publishes its Cyber Suite Liability application openly, which is what makes this comparison possible at all.

The published form, CYB9016-0320AS, carries five yes/no questions, and how many you answer depends on the limit you want. They ask whether you have suffered a breach of personal information in the last 12 months, whether you conduct background screens for prospective employees, whether you have a posted document retention and destruction policy, whether you maintain regularly updated computer security measures such as a firewall, secured wireless connectivity and virus protection, and whether physical records are maintained in a secure environment with limited access.

The tiering is the part worth noticing. The form offers $50,000 with a $1,000 deductible, $100,000 with a $1,000 deductible, and $250,000 with a $2,500 deductible, and it directs an applicant requesting the $50,000 limit straight to the authorization block without answering any of the five. Questions 1 through 3 apply at $100,000, and all five at $250,000. Underwriting depth scales with the limit requested rather than with the risk being insured.

Multi-factor authentication is not among the questions on this form. Neither are backups, which Travelers, Corvus and Beazley all ask about, nor patching or endpoint detection. Two honest caveats: this is the application TDIC publishes, and we cannot tell you what a broker asks in conversation or what a renewal or supplemental form might add. It is also older than the Corvus, Beazley and Travelers MFA forms: the form number ends in 0320 and the file dates to March 2020. Underwriting with fewer questions is a legitimate business decision, and for a single-location practice that wants coverage without a technical review, it is often exactly the appeal.

Now read what sits at the top of that same form. Of the forms in the table, TDIC’s is the only one that says warrant and rescind outright:

"You warrant and represent that the following statements are yours and that you know the statements to be true. You know and intend that we will rely on the truth of the information you have provided in deciding to issue a policy to you, and that providing any materially false information in this application is grounds for us to deny you insurance or rescind any policy we issue if the false information was material to our underwriting decision."

And further down: "IF A POLICY IS ISSUED, THIS APPLICATION WILL BECOME PART OF THE POLICY."

That is the part worth understanding. A short application is not a lenient one. It is a smaller set of statements you are still warranting (outside the states where the form treats them as representations), and each one covers more ground. Question 4, the one asking whether you maintain "regularly updated computer security measures," is a single checkbox covering a subject that other carriers break into a dozen or more questions. An office running an unsupported operating system has to think carefully about what answering it "yes" commits to.

How many questions a carrier asks tells you about its underwriting. Your ransomware exposure does not change with the length of the form.

Rescission, and What One Real Dispute Looked Like

There is a real case here, and it is worth getting exactly right, because a lot of what is written about it overstates what happened.

In July 2022, Travelers filed suit in the U.S. District Court for the Central District of Illinois against International Control Services, a manufacturer, seeking to rescind a CyberRisk Tech policy after a ransomware event. Travelers alleged that ICS had made incorrect statements in applying for the policy about its use of multi-factor authentication.

What happened next is the part that gets misreported. There was no trial and no adjudication of whether the misrepresentation legally voided coverage. Travelers filed an agreed motion, and on August 30, 2022, the court entered an order recording that both parties "stipulate and agree to the entry of an order rescinding the insurance policy in question and declaring it void from its inception." The court’s own order describes the misrepresentation as something "Travelers asserts," not something the court found. The policy was rescinded and the case was dismissed with prejudice, with each party bearing its own costs. In its complaint, Travelers had stated it was tendering back to ICS all amounts paid as premium, which is the ordinary mechanic of rescission: the carrier returns the money and the coverage is treated as though it never existed.

So nobody should write that this case produced a ruling that a bad MFA answer voids a policy. The court never decided that question. What the record does show is more useful to a practice owner: after a ransomware attack and a rescission suit over its MFA answers on the application and the MFA attestation, the policyholder agreed to give up the entire policy within two months of the suit being filed. A handful of answers about MFA put the whole policy in play, quickly.

That is the difference between a denied claim, where the carrier refuses one loss and the policy itself stays in place, and rescission, where the policy is treated as though it never existed. In the ICS matter the parties stipulated that no coverage would be available "for past, present, and future claims, suits, loss, costs, or expenses of any kind whatsoever."

An application answer is one of the things that can open the second door. Whether it does in any given case depends on the policy language, the materiality of the answer and the law of your state, which is exactly why the accuracy of the form is worth more attention than it usually gets.

Worth knowing: state law limits how far this can go, and the limits differ by state. TDIC’s own application carries state-specific amendments, and in Arizona, Hawaii and Nevada the form states that application statements "shall be deemed to be representations and not warranties." Read your state’s amendment on the form itself and ask your broker how it is applied. Nothing here is legal advice.

What to Verify Before You Sign the Application

Run these before the form goes back to your broker, not after.

Get the actual questions in advance and answer them with your IT provider

Ask your broker to send the application and any multi-factor authentication form before the renewal meeting. Then go through it with whoever runs your security. The Travelers supplement asks whether you did.

Enumerate every system MFA is supposed to cover

Not "do we have MFA" but: email, remote network access, directory services, the backup environment, firewalls and network gear, servers and endpoints, and any third-party administrative access. Your IT provider should be able to answer that list system by system. If the answer to any of them is "I think so," that is the finding.

Multi-location groups should run that list per location and write down any differences to disclose. That is the practical case for standardization: one consistent setup makes one accurate answer far easier to give than nineteen separate ones.

Produce the Security Risk Analysis before you answer the HIPAA question

Find the document, check its date, and check whether it describes the systems you actually run now. If nobody can produce one, or the one you have predates your current PMS or your last two locations, you have learned something more important than an insurance answer. Medix runs a formal Security Risk Analysis for practices and groups that have never had one.

Restore from a backup before you attest that you can

Not a successful backup log. An actual restore, with someone opening a patient record out of it. Some carrier questions specify a test window or a recovery time, and both are claims you should be able to demonstrate rather than estimate.

Ask whether the limit is per claim or aggregate, and what carries a sublimit

A $250,000 aggregate and a $250,000 per-claim limit are very different products. Ask specifically about notification costs, ransom payment mechanics, and funds transfer fraud. The Travelers application gives social engineering fraud and funds transfer fraud their own limit lines, so check whether your policy carries them and at what amount, especially if you pay vendors by bank transfer. Beazley’s application (question 21) also asks whether you confirm vendor payment-account changes out of band.

Confirm every practice entity is on the policy

List every legal entity your locations sit in and confirm with your broker that each one is insured under the actual policy, whether as a named insured, a Subsidiary under the policy definition, or by endorsement. Repeat it after every acquisition, and answer Beazley’s merger question with deals agreed to as well as deals closed.

Tell your carrier when the environment changes

Reporting duties differ by form, as the table shows, so read yours rather than assuming one exists or does not. Migrating your PMS, adding locations, changing IT providers, or opening remote access for a billing contractor can all change what you attested. Whether a change is material enough to report is a question for your broker, but a DSO acquiring practices should assume it comes up several times a year, which is one more reason IT due diligence before closing pays for itself.

One Thing an Insurance Broker Told Us in 2019

The first version of this article was built around a conversation with Josh Ehlen, then Vice President at Reynolds and Reynolds Inc., a Des Moines insurance agency that became part of USI Insurance Services in 2021. One thing he said has aged better than anything else in that piece:

"Cyber Liability coverage forms vary greatly depending on the carrier, which is why it is critically important to hire an insurance professional that only works with Cyber Liability carriers that offer the broadest coverage forms."

Everything above is evidence for that. Five yes/no questions at one carrier and a separately signed MFA supplement at another, with limits, sublimits and exclusions varying just as widely underneath. A broker who works in this line every day is worth more than a good rate, because the rate is the part that is easy to compare.

Where This Leaves a Practice or a Group

Cyber liability insurance is not a substitute for a security program. It is priced on one, and a policy can be conditioned on one.

The uncomfortable version: if the application describes controls your practice does not actually have, buying the policy does not fix the problem, it converts a technology problem into a coverage problem. You now have a document with your signature on it describing an environment you do not have, and that discrepancy surfaces at the exact moment you can least afford it.

The constructive version is that these applications are a free control checklist written by people with money on the line. Travelers, Corvus and Beazley have each published what they think matters. A questionnaire is not an audit, and answering it well is not proof that any control is set up correctly, but a practice that has these controls in place, has tested them, and can produce evidence behind each answer has done much of the work that makes ransomware harder to pull off. The policy then covers what its terms cover.

I have written this about acquisitions, and it applies cleanly here: IT diligence is not a checkbox. It is risk pricing. An underwriter is doing what a buyer does, pricing your risk from what can be verified. The difference is that the underwriter is asking you to price it yourself, in writing, before anything has gone wrong.

If you are filling out one of these and you get to the MFA section and are not certain of the answer, that uncertainty is the actual finding. We are happy to walk through the form with you the way these forms contemplate, whether or not you ever become a client.

Dental Cyber Insurance Application Questions

Who should actually fill out a dental practice’s cyber insurance application?

An authorized representative of the practice signs it, and the Travelers MFA supplement asks for an executive officer. But the security questions should be answered by whoever administers the systems, and at least one carrier makes that explicit: question 4 of the Travelers Multi-Factor Authentication Supplement (CYB-14306 Rev. 03-23) asks the signer to confirm the form was completed "with the assistance of the person in charge of IT security." The signature and the answers do not have to come from the same person, and on the technical questions they usually should not.

What is the difference between a cyber claim being denied and a policy being rescinded?

Denial refuses one specific loss, usually under an exclusion or an unmet condition, and the policy itself stays in place, subject to its other terms. Rescission unwinds the contract entirely and treats it as though it never existed, which removes coverage for past, present and future claims at once. The premium is typically returned. Denial usually turns on what happened during the incident, while rescission usually turns on what you said on the application.

Can a dental practice answer yes to the HIPAA compliance question on a cyber application?

Only if it can produce the documentation behind it. HIPAA compliance is not a certification anyone issues you, it is a set of documented practices anchored by a Security Risk Analysis that HHS expects to be conducted and reviewed periodically. Before checking that box, you should at least be able to hand an investigator a current risk analysis, your workforce training records, and your signed Business Associate Agreements. Those do not prove compliance on their own. If any of them cannot be produced, the honest answer needs a conversation with your broker rather than a checkmark.

What should a DSO check before signing one cyber application for every location?

A group application has to describe accurately every practice and system it includes, with differences or exceptions disclosed. Before signing, confirm that your MFA, backup, endpoint and patching answers hold at every site the application covers, or disclose the exceptions, and confirm who is answering for practices acquired since the last renewal. Then confirm each practice entity is covered, and disclose recent and pending acquisitions.

Does buying cyber insurance reduce a practice’s ransomware risk?

No, and the distinction matters more than it sounds. A policy transfers financial consequences after an incident, it does not prevent one. The controls the application asks about are what reduce the likelihood, which is why a practice with those controls in place and tested is in a better position than one that simply holds a policy.

Posted in Dental Cybersecurity