Indemnifying virus handlers - 'Hold harmless' statements of work?

How are virus handlers indemnified from the work they perform in either
test labs, or when removing viruses in the field?

Is it common practice for employees, consultants or companies to have
statements of work with 'hold harmless from and against' clauses, and
other statements which indemnify the worker from possible damage?  I
realize this only applies to possible civil suits, and does not protect
the worker from perceived violation of 'Fraud and Related Activity in
Connection with Computers':
http://www.usdoj.gov/criminal/cybercrime/1030_new.html

I notice it's common for penetration testers to have statements of work
which contain 'hold harmless' clauses, since a network scan or exploit
may disrupt a service or corrupt a database.  

Thanks,
Bill Stout