The picture people start with is usually too clean
Business interruption sounds like locked doors. The office is dark. Nobody is working. The problem is obvious. Cyber downtime is messier.
The lights may be on. Patients may still be arriving. Staff may still be working hard.
That is the strange part. The waiting room can look normal while the claims queue is frozen. Eligibility checks are failing. Billing is stacking up. The office manager is running manual workarounds that nobody wanted to remember from 2009. The doors are open. The money is still bleeding out.
But the schedule is unreliable, chart access is slow, billing is stuck, and every normal task takes twice as long.
That counts as downtime too. If you want the broader frame first, start with Healthcare Practices and Cyber & Modern Operational Risk. If the event started with a bad email, Why Phishing Is Still the Main Way Small Healthcare Practices Get Hit is the right companion.
What is really going on
Small practices do not lose productivity one department at a time. They lose it through congestion. The schedule gets wobbly because staff cannot tell what is current. Billing backs up because notes, attachments, or codes are not where they should be. The front desk answers the same question three different ways because nobody trusts the workflow yet.
The office may still collect some money. It just collects less, with more friction.
That is why cyber downtime in a practice does not feel like a warehouse fire. It feels like running the office with one boot on.
Where the money goes
There are usually two buckets at the same time.
Lost production
If the office normally produces $6,000 to $10,000 a day and spends two days half-operational, the shortfall can land around $12,000 to $20,000. That is not an extreme assumption. It is a normal office having two very bad days.
Extra expense
Then come the costs created because the day still has to move:
- overtime
- outside IT help
- temporary workarounds
- extra admin time fixing claims and schedules
- vendor coordination that would not exist in a normal week
This is why coverage that only sounds good on system restoration can still feel thin. The office is paying for the drag while the technical problem gets sorted out.
What people miss
The misses are practical, not dramatic. A practice may assume the event only matters if the office fully closes. A half-working office can be expensive enough.
It may assume the vendor’s uptime promise solves the revenue problem. Restoring the platform helps. It does not automatically replace yesterday’s cancelled appointments or the billing backlog.
It may also treat downtime as separate from breach response. In real life, they blend together. The same event can create forensic cost, legal review, patient questions, schedule drag, and delayed collections.
That is why What a Small-Practice Data Breach Actually Costs matters.
Simple decision rule
If two disrupted business days would feel like more than a nuisance, treat downtime coverage as part of the main cyber decision. Write down one ordinary day of production, one ordinary day of collections, and one likely cleanup bill. The coverage question gets clearer when the office math sits next to the policy language.
Next step
Take one normal week and mark the three functions that break fastest if systems go sideways: scheduling, charting, and billing. That usually tells you whether the cyber limit is built for the office you actually run. Minnesota note: winter reschedules already make the calendar brittle around the metro. Add cyber disruption and the backlog can outlast the outage. One system delay can ripple like missing a Green Line connection in St. Paul: the first delay is small, the afternoon is not.