The adroit and engaged management of cyber risk and data privacy risk is not sexy. It is loads more fun to think about way cool techniques for digital die-cutting and embellishment in the finishing department of the printing business. Or a fully integrated CRM and client file management system to deepen visibility into client needs and wants in the sales and prepress departments. Or, anything else that is notabout cybersecurity. Puhleeze!

But let’s think about a third-party medical billing firm in the recent incident at Mercy Health Lorain, in which a patient data breach occurred when a revenue cycle vendor mailed bills with social security numbers clearly visible in the address windows. In this case, the third-party vendor and a “business associate” under the HIPAA rule, mailed just under 6,000 envelopes to patients over a two-month period in late 2019.

Did the third-party provider have cyber insurance coverage that might help offset the cost of providing identity and reputation management protection to the 5,900 plus Mercy Health Lorain patients? If not, had the provider firm proactively budgeted for the potential impact of the cost of providing that protection, and the cost of printing the data breach notice letters? Did the provider have to engage a forensics team, or an incident response and recovery team, or a data breach specialist law firm? Perhaps most importantly, did the hospital fire the provider?