Yes.  I used to buy a separate policy through the AICPA Malpractice Insurance carrier AON-CNA.  Then changed to my regular business carrier who had a better policy.  You need to be aware of what it actually covers.  Most policies are really "lame" in that it only covers the cost of notifying clients, and the cost of giving them one year of credit report monitoring.  It does not cover the cost of being sued by a client for stolen data or stolen identity.  So READ before you purchase so you know what you're actually being covered for.