Medical practice insurance: coverage, requirements and costs

A physician practice's core policy is medical professional liability (malpractice), written on a claims-made or occurrence basis, with the decision about tail coverage made before any physician leaves. Around it sit cyber liability for patient records, general liability and property for the office, workers' comp, employment practices liability and, for group practices, management liability. The practice falls in NAICS 621111 (offices of physicians) and 621112 (physician mental health specialists). The trade's insurance problem is long-tail exposure: a claim can arrive years after the visit, and the policy that responds depends on when it is made, not when the care happened.

Why medical practices need business insurance

Claims are common and slow. The American Medical Association reported on May 4, 2026 that medical liability premiums have risen for a seventh straight year and that 28.7% of physicians had been sued at some point in their careers (2024 data). Payments on behalf of a physician must be reported to the National Practitioner Data Bank (45 CFR 60.7), so a settlement follows you into credentialing and license renewals.

The practice, not just the doctor, is exposed. Nurse practitioners, physician assistants, medical assistants and front-desk staff create vicarious liability. A practice owner can be sued for supervision, scheduling, test-result tracking and referral failures even when the physician did nothing wrong.

Patient records are a breach target. A medical practice is a HIPAA covered entity, so a ransomware event or lost laptop carries notification duties and possible federal penalties on top of the cost to recover. See HIPAA breaches and cyber insurance for healthcare providers.

Standard commercial policies exclude professional services. A general liability policy or BOP generally excludes medical professional services. The practice needs a malpractice policy and cannot rely on a BOP for patient injury from care.

Core coverages

• Medical professional liability. Pays defense and damages for claims of negligent care. Forms differ on limits (per claim and annual aggregate, commonly written per physician), whether defense costs erode limits, the consent-to-settle clause (whether the insurer can settle without the physician's agreement and what happens if you refuse), coverage for employed non-physician providers, and whether the practice entity is an insured. See medical malpractice insurance for physicians and practices. The Doctors Company and MagMutual both state on their websites that they offer malpractice or medical liability insurance for physicians and practices.
• Claims-made versus occurrence. An occurrence policy covers an incident that happens during the policy period, whenever the claim comes. A claims-made policy covers claims first made while the policy is in force, for incidents after the retroactive date. Most malpractice is claims-made because it is cheaper at first, so you must keep continuous coverage or buy an extended reporting period (tail) when you leave or change carriers. A new carrier can instead give prior acts (nose) coverage. See occurrence vs claims-made policies, tail coverage and extended reporting periods and tail coverage cost calculator.
• Cyber. First-party breach response (forensics, notification, credit monitoring, data restoration, business interruption) and third-party regulatory defense and liability. MagMutual's website, for example, describes coverage for data breaches and regulatory violations such as HIPAA. See cyber insurance: what it covers for a business.
• General liability, property and equipment breakdown. Slip-and-fall in the waiting room and damage to leased space; imaging and lab equipment, refrigerated medications and vaccines. Business income matters because a practice with a closed office loses visits that cannot be rescheduled.
• Employment practices liability and workers' compensation. Medical staff face needlestick and sharps, lifting and exposure injuries. See employment practices liability.
• Management liability and crime. Group practices and physician-owned entities face claims from partners, payers and employees; billing and embezzlement exposures call for crime cover.

Coverage you may be required to carry

Most states do not impose a general statutory malpractice insurance requirement on physicians, but some do, and hospitals, payers and employers usually require it for privileges and contracts. Verified examples:

• Wisconsin requires each provider to carry at least $1,000,000 per occurrence and $3,000,000 per policy year for occurrence coverage, and $1 million per claim and $3 million per reporting year for claims-made coverage (Wis. Stat. 655.23(4)(b)2). The state's Injured Patients and Families Compensation Fund pays excess; participation is mandatory for most physicians practicing over 240 hours a year, per ProAssurance's summary.
• Kansas requires resident health care providers to carry at least $500,000 per claim and $1,500,000 annual aggregate on policies issued or renewed on or after January 1, 2022 (K.S.A. 40-3402(a)); before that the limits were $200,000 and $600,000. The Health Care Stabilization Fund pays amounts above the basic coverage (K.S.A. 40-3403(c)(1)).
• Florida requires physicians to show financial responsibility by one of three methods (escrow, insurance, or letter of credit): at least $100,000 per claim with a $300,000 annual aggregate, or $250,000 per claim and $750,000 aggregate for physicians with hospital staff privileges or who operate at ambulatory surgical centers. Certain exempt physicians must post a notice that they have decided not to carry malpractice insurance, as Fla. Stat. 458.320 describes.

Patient compensation funds are state-created programs that sit above the provider's underlying liability insurance and cap the provider's own exposure. ProAssurance's risk-management summary lists Indiana, Kansas, Louisiana, Nebraska, New Mexico, Pennsylvania and Wisconsin, with participation mandatory for most providers in Kansas, Pennsylvania and Wisconsin and voluntary elsewhere. The rules, limits and surcharges change; check the fund and your state medical board or insurance department before relying on a summary. A hospital or payer may require higher limits than the statute does.

Other requirements. Workers' comp follows state law (see workers' comp requirements by state: who must carry it); leases require GL and property; payers' credentialing and hospital privileges ask for certificates of malpractice insurance and for tail or prior acts when you switch. Telehealth across state lines raises licensure and coverage questions; see telehealth and malpractice coverage.

Common claims and how to prevent them

• Missed or delayed diagnosis. A system to track every test result, referral and no-show, with a documented closed-loop process.
• Medication errors. Reconciliation at every visit and electronic prescribing checks.
• Consent and communication. Documented informed consent and clear patient instructions; poor communication drives many complaints into claims.
• Mid-level supervision. Written protocols for NPs and PAs, chart review schedules, and state-law compliance on supervision.
• Breach and ransomware. Under the HIPAA Breach Notification Rule, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404); the media must be notified for breaches affecting more than 500 residents of a state (164.406); HHS must be told at the same time as individuals for breaches of 500 or more, and for smaller breaches within 60 days after the end of the calendar year (164.408). Civil money penalties for HIPAA violations, adjusted for 2025, range from $145 to a maximum of $2,190,294 per violation depending on the tier. Controls: risk analysis, encryption, multi-factor authentication, access logs, offline backups.
• Occupational injuries. Sharps safety devices and exposure-control plans.
• Employment. Written policies for scheduling, harassment and wage and hour compliance.

What drives the cost

• Malpractice: specialty and procedures (surgery and obstetrics are priced far above family medicine), state and county (litigation climate and any patient compensation fund), limits, the claims-made year (first-year policies cost less and step up), claims history, board certification, and whether you employ mid-level providers.
• Cyber: revenue, number of patient records, and controls such as multi-factor authentication and tested backups.
• General liability: revenue or square footage; workers' comp: payroll by class code, with clinical staff in a higher class than office staff.
• Underwriting questions: specialties, procedures performed, hours and locations, supervision of mid-levels, risk-management participation, claims and board history, and tail or retroactive date.

Specialized coverages to consider

• License protection / disciplinary defense for board complaints.
• Billing errors and omissions (regulatory defense for coding and billing audits).
• Tail coverage or a nose endorsement on leaving or retiring; see tail coverage and extended reporting periods.
• Umbrella for limits above the primary.
• Cyber extortion and business interruption; see ransomware.

How to buy

Physician-owned and specialist carriers write most malpractice, and the larger groups use brokers who know the specialty and state. Compare the claims-made retroactive date, the tail terms (many carriers waive tail on death, disability or retirement after a period), who the insured entities are, and whether defense costs are inside the limit. Have ready: physician list with specialties and procedures, claims history and currently open matters, number of mid-level providers, patient volume, EHR and security controls, and the employment or partnership agreements that govern tail responsibility. Ask who pays for tail when a physician leaves, and put it in writing. See how to prepare an insurance submission underwriters will read.

Key takeaways

• Malpractice is the core policy; a BOP does not replace it.
• Claims-made coverage needs continuity or tail; decide who pays tail before a physician leaves.
• A few states set statutory minimums (Wisconsin $1 million/$3 million; Kansas $500,000/$1.5 million; Florida $100,000/$300,000 or $250,000/$750,000) and run excess funds; hospitals and payers often require more.
• HIPAA breach notices are due without unreasonable delay and within 60 days of discovery; large breaches go to HHS and the media.
• Buy cyber and keep MFA, encryption and offline backups documented.