Cyber insurance policies could help pay for the expense of losses due to ransomware attacks, however, these policies are harder to lay claim to. Insurance companies are tightening up their prerequisites for getting policies and a lot of insurance companies are putting restrictions on underwriting sums. Premiums are likewise rising, making policies too expensive for a lot of healthcare providers, when insurance may even be acquired. There have been more negative news this week for healthcare companies that cannot get cyber insurance, since the Ohio Supreme Court has lately decided that ransomware attacks are not tantamount to physical damage, meaning claims against property insurance plans are not possible.
This decision concludes the 3-year court case between the insurance provider, Owners Insurance Company, and medical billing software company, EMOI. EMOI encountered a ransomware attack last September 2019 and paid the $35,000 ransom demand to recover files access to its files. EMOI additionally bought upgrades to its security facilities to stop more attacks. The ransomware group gave the data decryption keys and the majority of files were retrieved; nevertheless, the automated phone call system cannot be decrypted and needed to be replaced.
EMOI filed a claim with its property insurance plan seeking to recuperate the losses, however, the claim was declined. EMOI subsequently filed a lawsuit against Owners since the insurance policy included direct physical damage to digital files. Owners stated that the ransomware attack didn’t have a physical aspect, thus it was not covered by the insurance plan, and the policy doesn’t include losses due to ransomware.
Last November 2021, an Ohio Appellate Court decided in support of EMOI and permitted a claim against the insurance provider for dealing with EMOI in bad faith, by not completely considering the different types of damage that could happen to media like software programs; nevertheless, all seven justices of the Ohio Supreme Court took Owners’ side and released a summary judgment dropping the EMOI legal case.
EMOI had contended that computer software program is categorized under “media” that could be destroyed. Although the software program is non-physical, the insurance policy must still cover the losses even if the hardware is not damaged. The Supreme Court justices were not convinced by that point, deciding that the phrase “direct physical loss of or damage to” is to mean direct physical damage to its media.
Although the phrase “computer software” is included in the meaning of “media”, the justices decided that computer software was just included insofar as the software program is included in covered media, and that covered media indicates the media has a physical presence. Because there was no direct physical loss or physical damage to the protected media that contain the computer software, the policy does not cover the losses. Additionally, computer software can’t have a direct physical loss or physical damage since it doesn’t have a physical presence.