No. A standard general liability policy covers bodily injury and property damage you cause to other people. It does not cover a data breach, a ransomware attack, or the cost of telling your patients or clients that their information was exposed. Most general liability policies written in the last several years say so in an exclusion, in plain language. If general liability is the only commercial policy you carry, a breach is an uninsured event.
We get this question from Austin and San Antonio business owners more than almost any other. Usually it comes up after a client, a landlord, or a hospital contract asks for proof of cyber coverage and the owner assumes the general liability certificate will do. It will not, and here is why.
What general liability actually covers
General liability is built around two things: someone gets hurt, or someone’s physical property gets damaged, and it is your fault. A patient slips in your lobby. A contractor’s ladder goes through a client’s window. Your delivery driver backs into a fence. Those are general liability claims, and the policy responds well to them.
It also includes a narrow coverage called personal and advertising injury, which handles things like libel, slander, and copyright infringement in your advertising. Years ago, some business owners and even some attorneys argued that a data breach was a kind of personal injury, because it exposed private information. Carriers responded by adding an exclusion. The standard form now says, in effect, that loss of or access to electronic data is not covered. Most policies issued today carry that language.
What a breach actually costs
The part most owners underestimate is that the expensive piece of a breach is not the lawsuit. It is everything that happens before anyone sues.
- A forensics firm has to figure out what was taken and how.
- An attorney has to tell you which notification laws apply. Texas has one; so do most other states, and if you have patients or clients outside Texas, theirs apply too.
- You have to notify every affected person in writing, often with credit monitoring offered.
- If you are a medical or dental practice, HIPAA has its own notification rules and its own penalties.
- If the attack was ransomware, your systems are down until they are rebuilt or the ransom is negotiated, and your revenue stops while that happens.
All of that is first-party cost: money you spend, not money you owe someone else. General liability has no mechanism to pay first-party costs at all. It is a liability policy. It pays others on your behalf.
What does cover it
Cyber liability insurance, sometimes called cyber or data breach coverage, is a separate policy built for exactly this. A good one pays for the forensics, the attorney, the notification, the credit monitoring, the ransom and the negotiator, the lost income, and the system rebuild. It also covers the third-party side: lawsuits from affected people, regulatory penalties where they are insurable, and card-processor fines if payment data was involved.
Some professional liability and malpractice policies include a small cyber sub-limit, often a fraction of the main limit. It is better than nothing. It is not a substitute for a real cyber policy, and we tell clients that when we quote them.
A composite example
A six-provider medical practice in Central Texas gets a phishing email. A staff member enters credentials on a fake login page. Two weeks later the practice’s email is being used to send invoices with changed banking details, and the attacker has had access to a mailbox containing patient correspondence. The practice has general liability, property, workers compensation, and malpractice, and no cyber policy.
The forensics firm alone is a five-figure engagement. The attorney determines that HIPAA notification is required for every patient whose information was in that mailbox. The practice pays for all of it out of operating cash. The general liability carrier denies the claim, correctly, citing the electronic data exclusion. The malpractice carrier has no coverage for it either. Nobody sued, and the practice still spent more than a year of cyber premiums in six weeks.
That is the pattern we see. The claim is real, the cost is real, and the policy the owner thought would respond was never designed to.
What to do this week
- Pull your general liability policy and look for the words “electronic data” in the exclusions. It is usually there.
- Count the records you hold. Patients, clients, customers, employees. That number drives both your exposure and your cyber premium.
- Turn on multi-factor authentication for email, remote access, and backups. Cyber carriers now ask about it on every application, and some will not quote without it.
- Get a cyber quote. Send us your general liability declarations page, your annual revenue, and that record count. We will tell you what the market looks like for a practice your size. Read more about cyber liability, or call or text (512) 488-3586.
Frequently asked questions
Does a business owner’s policy (BOP) cover a data breach?
Usually not, or only with a small add-on limit. A BOP bundles general liability and property coverage; it inherits the same electronic data exclusion. Some carriers offer a cyber endorsement on a BOP, which can be a reasonable starting point for a very small business, but check the limit and the exclusions before relying on it.
Does my malpractice policy cover a data breach?
Usually not, or only with a small sub-limit. Malpractice responds to claims that your professional work harmed a patient or client. A breach is not professional work. Some carriers add a modest cyber sub-limit; it is rarely enough for a real incident.
Is cyber insurance required in Texas?
Not by state law. It is increasingly required by contract: hospital privileges, payer agreements, landlord leases, and enterprise client contracts often ask for it, and some lenders do too.
How much does cyber insurance cost?
It depends on your industry, revenue, the number of records you hold, and your security controls. Rather than quote a range that will not match your situation, we will give you real numbers from several carriers.
Nightlight Insurance Agency, LLC is an independent insurance agency based in Austin, Texas, serving Austin, San Antonio, and Central Texas. Texas Department of Insurance General Lines Agency License 2803067. This post is general information, not a coverage determination. Your policy language controls.
