Industry Insight
Aged care providers face dual obligations under both the Privacy Act 2020 and Health Information Privacy Code.
Why Aged Care Businesses Need Cyber Insurance
Aged care providers hold some of the most sensitive personal and health information in the economy. They are also subject to both the Privacy Act 2020 and the Health Information Privacy Code. Many operate with legacy IT systems, creating vulnerability to ransomware and data theft attacks.
The Privacy Act 2020 introduced mandatory breach notification obligations for all businesses that hold personal information. When a breach is likely to cause serious harm, you must notify both the Office of the Privacy Commissioner and affected individuals — a process that requires legal guidance and carries real cost. Cyber insurance covers those obligations and puts expert advisors in your corner from the moment an incident occurs.
We make this straightforward. We compare policies from multiple insurers, explain what's actually covered in plain language, and personally vet the brokers we recommend — so you get the right protection without having to wade through complex policy documents yourself. CERT NZ data shows the average data breach costs businesses $173,000 — cover starts from a fraction of that.
Top Cyber Risks for Aged Care Businesses
- 1Resident health and personal data breach
This is consistently the most reported and highest-cost cyber loss type for Aged Care businesses in New Zealand.
- 2Ransomware on care management systems
- 3Staff credential theft
- 4Third-party vendor compromise
- 5Regulatory action (Privacy Commissioner)
Recommended Coverage for Aged Care Businesses
The following coverage types are most relevant for Aged Care businesses based on sector-specific risk profiles. Your broker will confirm which apply to your specific situation.
For a full explanation of each coverage type, see our Coverage Guide.
How Cyber Insurance Claims Work for Aged Care Businesses
If you experience a cyber incident, follow these steps. Your insurer — not this website — is your primary resource. Contact them first.
Call Your Insurer Immediately
Contact your insurer's 24/7 breach hotline the moment you suspect an incident. Do not attempt to restore systems, wipe devices, or notify customers until you have spoken with them. Delays can affect your claim.
Incident Triage & Response Team Deployment
Your insurer deploys a specialist incident response team — typically forensic investigators, legal counsel, and a breach coordinator. They assess scope, contain the attack, and advise on next steps.
Investigation & Notification
If personal data was compromised, your legal team advises on Privacy Act notification obligations. Your insurer covers the cost of notifying the Privacy Commissioner and affected individuals.
Recovery & Restoration
Systems are restored, data recovered where possible, and business interruption losses are calculated. PR and reputation management support is provided if required. Your claim is assessed and settled.
What Cyber Insurers Look For When Assessing Aged Care Businesses
Insurers assess your security posture before offering cover. The following controls are commonly evaluated — and having them in place typically reduces your premium:
Multi-Factor Authentication (MFA)
Required on all email accounts, remote access and cloud systems. Single most important control for reducing ransomware and BEC risk.
Regular, Tested Backups
Backups stored separately from production systems, tested for restoration at least quarterly. Immutable backups (cannot be deleted by ransomware) are increasingly required.
Software Patching & Updates
Timely application of security patches to operating systems, applications and remote access tools. Unpatched systems are the most common ransomware entry point.
Incident Response Plan
A documented plan identifying who to call, what to do, and what NOT to do in the first 24 hours of an incident. Some insurers require this for higher coverage limits.
Staff Security Awareness Training
Regular training on phishing recognition and safe practices. Particularly valued by insurers as human error remains the leading cause of cyber incidents.
Typical Premium Range for Aged Care Businesses
Premiums vary by revenue, data held, sector, security controls and limits selected. Because we compare across Chubb, AIG, Zurich, Delta Insurance, QBE and Berkley Insurance, we regularly find businesses are paying more than they need to with their current insurer — or have gaps in cover they weren't aware of.
Compare NZ Cyber Insurers →Frequently Asked Questions — Aged Care Cyber Insurance
Do Aged Care & Community Services need cyber insurance in New Zealand?+
What does cyber insurance cover for Aged Care businesses?+
How much does cyber insurance cost for Aged Care businesses in NZ?+
What is the biggest cyber threat facing Aged Care businesses?+
What happens when a Aged Care business makes a cyber insurance claim?+
Is ransomware covered by cyber insurance for Aged Care businesses?+
Related Resources for Aged Care Businesses
When Hospitals Go Dark: What NZ Healthcare Businesses Must Learn From Cyber Attacks
7 min read
The Privacy Act 2020 and Your Business: What You Need to Know
6 min read
What Does Cyber Insurance Actually Cover? A Plain-English Guide for NZ Businesses
8 min read
Useful Regulatory Resources
These government and industry bodies provide authoritative guidance on cyber security and data protection obligations for businesses.
CERT NZ
National cyber security authority — incident reporting and threat guidance
Office of the Privacy Commissioner
Privacy Act 2020 compliance and breach notification guidance
Insurance Council of NZ (ICNZ)
Industry body for NZ insurers and fair insurance code
Financial Markets Authority (FMA)
Regulation of NZ financial advice and insurance advisors