LPL Gap Analysis

LPL policies were originally built to cover lawyers for professional malpractice. The first LPL policies provided attorneys with liability coverage for errors or omissions committed in the course of providing professional legal services resulting in financial loss suffered by clients. Although LPL policies have evolved to cover a broader range of legal services and some peripheral exposures such as personal injury (i.e. defamation, malicious prosecution, false arrest), most LPL policies available today still limit coverage to professional malpractice only. They have not been updated to address the drastic changes in the legal industry and the new liability risks, which means numerous coverage gaps exist. One such area where many coverage gaps in LPL policies exist is cyber risk.

LPL policies were not designed to cover cyber risk and LPL insurers don’t underwrite the exposure or charge a premium for it. As such, many LPL insurers decline cyber risk claims submitted under LPL policies even when there isn’t a specific cyber risk exclusion or in instances where coverage appears to fall into a gray area. Please see the table below for a high level overview of common coverage in LPL policies for cyber risk.

Third-Party Liability
Cyber Risks
Lawyer's Professional Liability
Insurance Coverage
Defense Expenses Damages, Fines and Penalties Remediation Expenses
Liability for confidential data (NPI, PII) breaches and loss remediation expenses Defense expenses are arguably covered in broad "duty to defend" LPL policies, but regulatroy investigations and defense are not. While some types of civil damages may be covered, consumer redress, regulatory fines and penalties are not likely covered. No coverage for notification expenses and remediation solutions provided to affected parties.
Liability for damage to the electronic property of others or transmission of a computer attack Loss of client data may be covered. Damage to data of others (non-clients) or transmission of a computer attack probably won't be covered. A small sliver of coverage for damage to client data may exist. Damages for other suits are arguably not covered. No coverage for cleanup, repairs, and notification expenses.
Liability for performance delays or failure to deliver services Although some LPL policies have exclusionary language many LPL insurers will provide this coverage for performance failure or delay when caused by cyber risk. However, regulatory coverage for such failures is not provided. Many LPL policies will provide coverage for compensatory and punitive damages. In most cases regulatory damages are not covered. LPL policies do not appear to provide coverage for remediation or re-performance of services.
Advertising and publishing liability Some LPL policies provide limited personal injury coverage, so defense costs for certain media perils may be covered. Damages for covered media perils may be covered, but regulatory fines and penalties are probably not covered. Costs associated with cleanup, withdrawal or corrections are not typically covered in LPL policies.
First-Party Property
Cyber Risks
Lawyers Professional Liability
Insurance Coverage
Direct and Consequential Loss Proof of Loss Costs Remediation Expenses
Damage to your electronc property Arguably Not Covered Arguably Not Covered Arguably Not Covered
Disruption of your computer system resulting in lost income and extra expense Arguably Not Covered Arguably Not Covered Arguably Not Covered

In addition, a significant increase in cyber risk incidents at law firms in 2013 is starting to change the way LPL reinsurers view cyber risks, which will result in an increase of specific cyber risk exclusions or limiting endorsements in LPL policies in the near future. That being said, LPL policies do not currently have specific cyber risk exclusions or endorsement, so there is some very narrow coverage for cyber risk in some LPL policies today. We believe it’s important to understand what, if any, cyber risk coverage a law firm’s LPL policy provides before building appropriate cyber risk coverage.