Usually IT Consultants carry business insurance including errors and omissions insurance. As for the passwords, those should be changed once the consultant is no longer your IT provider. You are right though that the consultants need passwords from you on occasion.