Health Care Industry Reminded Again About Cybersecurity Risks With Cloud Vendors

The Ohio Supreme Court ruled last week that insurance coverage was not available to a cloud-based medical software provider because, under the applicable insurance policy, “[c]omputer software cannot experience ‘direct physical loss or physical damage’ because it does not have a physical existence.” While acknowledging that software is code-based, the court found that ransomware did not create the physical damage required under the insurance policy, exposing the company to the full costs of responding to the incident.