The current Southeast minimum for a small physician practice is $1M per event / $2M aggregate on a stand-alone cyber policy — not the historical $250,000 sub-limit tucked inside a BOP, which is functionally worthless in 2026. Because the HHS Office for Civil Rights treats every unencrypted PHI record as a discrete HITECH Act violation, a practice with 4,200 active patient records faces theoretical statutory exposure of $210,000 to $6.3M in fines alone before breach notification and forensic costs.
Required endorsements: ransomware payment, business interruption (60-day waiting period), regulatory defense (OCR plus state AG), patient notification/credit monitoring for 24 months, and social-engineering fraud.
