The part people picture wrong
When owners hear “business interruption,” they often picture the office dark and the doors locked.
Cyber losses are usually messier than that.
The lights are on. Staff are present. Patients may still be coming in. But the schedule is unreliable, chart access is slow or partial, claims are not moving cleanly, and every ordinary task takes twice as long as it should.
That is downtime too.
If you want the broader frame first, start with Healthcare Practices and Cyber & Modern Operational Risk. If the event started with a bad email, Why Phishing Is Still the Main Way Small Healthcare Practices Get Hit is the right companion.
What’s really going on
Small practices do not lose productivity one department at a time.
They lose it through congestion.
The schedule starts to wobble because people cannot confirm what is clean, who needs to be moved, or whether the system view is current. Billing backs up because attachments, codes, or claim notes are not where they should be. Front-desk staff answer the same question three different ways because nobody trusts the workflow yet.
The office may still collect some money that day. It just collects less, with more friction.
That is why cyber business interruption in a practice does not feel like a warehouse fire. It feels like the office trying to run with one boot on.
Where the money goes
There are usually two cost buckets at the same time.
Lost production
If the office normally produces $6,000 to $10,000 in a day and spends two days half-operational, the shortfall can land somewhere around $12,000 to $20,000 before anyone has fully sorted out the data side.
That is not a dramatic assumption. That is just a normal office having a bad two days.
Extra expense
Then you get the clean-up costs that exist because the day has to keep moving:
- overtime
- outside IT help
- temporary workflow workarounds
- extra admin time fixing claims and rescheduling patients
- vendor coordination that would not exist in a normal week
This is why a policy that only sounds good on restoration can still feel thin. The office is paying for the drag while the systems are being sorted out.
What people miss
The first miss is assuming the event only matters if the practice fully closes.
That is too blunt. A half-working office can be expensive enough.
The second miss is assuming the vendor’s uptime promise solves the revenue problem. A vendor restoring the platform is useful. It does not automatically fix yesterday’s cancelled appointments or the billing work that just stacked up in the corner.
The third miss is treating downtime as separate from breach response. In real life, they blend together. The same incident that creates legal and forensic cost often creates schedule drag and delayed collections too.
That is why What a Small-Practice Data Breach Actually Costs matters. The office-level loss is almost never one neat bucket.
Simple decision rule
If the practice would feel two disrupted business days as more than a nuisance, treat downtime coverage as part of the main cyber conversation.
Do not leave it buried as a vague maybe.
Write down one ordinary day of production, one ordinary day of collections, and one likely clean-up bill. The coverage question gets clearer when the office math is sitting next to the policy language.
Next step
Take one normal week and mark the three functions that break the fastest if systems go sideways: scheduling, charting, and billing. That usually tells you whether the cyber limit is really built for the office you run.
Minnesota note: winter reschedules already make the calendar brittle around the metro. Add a cyber disruption on top of that and the backlog can hang around longer than the actual outage.