A New AI Exclusion May Have Quietly Landed on Your Liability Policy. Here’s Where to Look.
Author
Article Summary
AI is helping healthcare move faster. It is also giving attackers new tools and rewriting insurance policy language. Here is what to check before your next renewal.
Questions to Evaluate Your Exposure:
- Does anyone in your organization use an AI scribe, ambient documentation, or a general-purpose assistant?
- Does any vendor touch your protected health information through an AI-enabled tool?
- Has anyone read your schedule of forms since your last renewal?
A yes to any of these means you have AI exposure, and possibly an exclusion nobody flagged.
AI Cuts Both Ways
Most boardroom conversations about AI focus on the upside: less administrative burden, faster documentation, better scheduling. That upside is real. The same technology is working for the other side.
- Better Bait. Phishing used to give itself away with typos. AI-written messages and deepfake voice or video impersonations now sound like the colleague down the hall. IBM flags deepfake impersonation and AI-enabled malware as the leading drivers of AI-driven attack growth.
- Shadow AI. When a well-meaning employee pastes patient notes into a free chatbot, PHI leaves your control instantly. Breaches involving high levels of shadow AI cost $670,000 more on average, and 63% of organizations studied had no AI governance policy or were still developing one.
- More Ways In. Quiet, data-theft-only extortion, where attackers steal data and threaten to publish it without encrypting anything, tripled to 12% of healthcare ransomware attacks in 2025.
AI is not the enemy. AI without governance is a liability.
Your Vendors Are Your Risk
Change Healthcare is the cautionary tale. One vendor, one compromised connection, and an estimated 192.7 million people were affected. Providers that were never breached lost weeks of claims processing and cash flow. Investigators found the attackers entered through a remote access portal using stolen credentials, with multifactor authentication not enabled.
If your vendor risk program is a contract with a Business Associate Agreement attached, you are not managing vendor risk. You are documenting it.
What actually closes the door is contractual: indemnification, a security exhibit with notification timelines, audit rights, and insurance requirements that name your organization.
The Fine Print is Changing, Across More Than One Line
- The Exclusions are Spreading. Similar language is migrating into D&O, E&O, and cyber forms, and some carriers are writing their own versions. Medical professional liability deserves particular attention, since an AI-assisted diagnosis or documentation claim may be affected there first. Each line can narrow independently, which creates gaps no single policy was built to close.
- “Arising Out of” is Broad. Depending on the wording, it can reach well beyond AI-generated content.
We have seen this movie before. A decade ago, “silent cyber” meant organizations learned after a loss that the policy they thought covered it did not. Silent AI is the same pattern. Affirmative AI coverage is emerging through cyber, tech E&O, and standalone products, but you have to ask, and you have to get the answer in writing.
Check the schedule of forms, not the certificate. A certificate lists limits. The exclusion lives on the form schedule attached to the policy. If CG 40 47 or a carrier equivalent is listed, the coverage you assumed you had for an AI-caused injury is gone.
Do Not Wait for the Rule
The U.S. Department of Health and Human Services’ Office for Civil Rights keeps enforcing under the rule as it stands. In April 2026, it announced four more ransomware settlements, bringing completed ransomware investigations to 19. The most common finding is a failure to conduct an accurate, thorough risk analysis.
The proposed HIPAA Security Rule overhaul would eliminate “addressable” flexibility and mandate encryption and multifactor authentication. It is still a proposal, and the final rule has slipped to July 2027. Waiting is a gamble. Underwriters and plaintiffs' attorneys already look for those same controls. Your renewal is the deadline that matters.
Where to Start
- Develop an AI Use Policy with Legal Compliance Guidance. Define approved tools, what data can never go into them, and who to ask.
- Inventory Your AI and Your Vendors. Know who touches your systems and PHI, and what your rights are if they are breached.
- Close the Basics. Multifactor authentication, access controls, and patching still stop the most common attacks.
- Test the Plan. Run a tabletop with a vendor outage and a deepfake wire request.
- Review the Whole Program. Ask for AI exclusions and sub limits across cyber, CGL, medical professional liability, tech E&O, and D&O before renewal, not after a claim.
- Questions to Bring to Your Next Renewal Meeting:
- If a key vendor goes down, does our policy cover the lost income?
- Are deepfake-enabled payment fraud and social engineering covered, and at what limit?
- Does coverage depend on conditions like MFA, backups, or an AI governance policy?
- Are regulatory defense costs and fines covered where the law allows?
- Do our cyber, tech E&O, D&O, and professional liability policies work together, or are there gaps?
The threat landscape has changed. The question is whether your risk program has.
Ready to go deeper? If your healthcare organization’s insurance policies haven’t been reviewed for AI exclusions and coverage gaps, that’s where the work starts. Let’s review how your cyber and liability policies work together before your next renewal. Connect with a member of our Property and Casualty team.
________________________________________________________________________