Yes — absolutely. Cloud-EMR vendors like Athena, Epic, and eClinicalWorks carry their own cyber coverage, but that policy protects the vendor, not the covered entity. Under HHS OCR guidance, the physician practice remains the “covered entity” and bears primary breach-notification, forensic-IT, and regulatory-defense costs when patient PHI is exposed — even when the root cause is the vendor’s fault.
A $1M/$2M dedicated cyber policy with ransomware, business interruption, and regulatory-defense endorsements is the current Southeast standard. Learn more from the HHS OCR Breach Notification Rule.
