Medical Practice Insurance: 2026 Guide
A medical practice is really two businesses stacked on top of each other from an insurance standpoint. There is the clinical side — where the defining risk is a patient alleging that diagnosis, treatment, or care fell short and caused harm — and there is the ordinary business side, a physical office full of staff, equipment, and patient records. Those two profiles pull in different coverage lines, and the biggest mistake practices make is assuming one policy covers both.
This is an independent guide from QuoteSweep, which maps the modern commercial insurance landscape. QuoteSweep does not compete with any of these companies, and none pays for placement here.
TL;DR: Build the program around professional liability — for a practice, that is medical malpractice — because general liability explicitly excludes clinical errors. Add a BOP for the premises and equipment, workers' comp for clinical and front-desk staff, and cyber because you hold protected health information under HIPAA. Hiscox and Embroker fit the professional-liability and business side, Coalition is the cyber benchmark for PHI exposure, and Gravie covers health benefits for your own staff. Every premium is quote-based.
What insurance does a medical practice need?
Professional liability (medical malpractice) — the core line
For most businesses professional liability is a cross-sell. For a medical practice it is the center of the program. Professional liability, or errors and omissions (E&O), protects against claims that a professional service caused a client a loss — and for a practice that service is patient care, so the coverage takes the specific form of medical malpractice (medical professional liability). It responds when a patient alleges that diagnosis, treatment, or a missed condition caused harm.
The reason this line is non-negotiable is a gap most owners underestimate: general liability explicitly excludes professional services errors. A patient who slips in the waiting room is a GL claim; a patient who alleges the wrong diagnosis is not — that is a malpractice claim, and GL provides zero coverage for it. The malpractice policy is the only thing standing between the practice and that exposure.
Two mechanics of E&O matter enormously here, because malpractice is almost always written on a claims-made basis rather than the occurrence basis GL uses:
- Retroactive date — coverage only reaches back to this date. Care delivered before it is not covered even if the claim surfaces later, so a practice should negotiate the earliest possible retroactive date and preserve it when switching carriers.
- Tail coverage (extended reporting period) — because patient claims can surface years after treatment, a practice that cancels or lets the policy lapse loses coverage for past care unless it buys tail. Tail commonly runs 125–300% of the expiring annual premium, which is a real number for a retiring or relocating provider to plan around.
General liability and a BOP — the premises and equipment
General liability covers the non-clinical side: a patient or visitor slips on a wet floor, a delivery person is injured on the premises, or the practice damages a landlord's property. It is written on an occurrence basis with standard $1M-per-occurrence / $2M-aggregate limits and is required by nearly every commercial lease — including the medical office space most practices rent. Physicians' offices even have their own ISO class code (47050) for GL rating.
Most office-based practices are better served bundling that GL into a business owner's policy (BOP), which combines general liability with commercial property in one policy at a bundled discount versus buying each separately. The property side is what protects exam-room and diagnostic equipment, waiting-room contents, and tenant improvements to the leased suite, and most BOPs build in business interruption and equipment breakdown at no extra charge — meaningful for a practice that can't see patients if its imaging or lab equipment goes down. Office-based practices with straightforward risk profiles typically qualify; higher-hazard settings (surgical centers, larger multi-site groups) can outgrow BOP eligibility and move to a commercial package policy. Note that any cyber sub-limit endorsed onto a BOP is small — a fraction of a real breach cost — which is exactly why cyber gets its own line below.
Workers' compensation — for clinical and front-desk staff
Workers' comp is mandatory in nearly every state the moment a practice has employees, and a practice has several kinds: nurses and medical assistants, front-desk and billing staff, and the providers themselves. The clinical exposures are real — needlestick and sharps injuries, back strain from lifting or repositioning patients, and exposure to infectious illness — which is why the line is legally required and non-negotiable.
Premiums are driven by payroll, not revenue: the formula is (payroll ÷ 100) × class-code rate × experience modification rate (EMR). Clinical staff and clerical staff carry different NCCI class codes and very different rates, so accurate classification matters, and the practice's own claims history flows into its EMR — an EMR below 1.0 earns a discount, above 1.0 a surcharge. Because carriers audit payroll at year-end, a growing practice should estimate payroll accurately upfront to avoid a large audit bill. Compare options on the workers' comp hub.
Cyber — because a practice runs on PHI
Cyber is where medical practices are most exposed and most often under-covered. A practice stores exactly the data attackers want — protected health information (PHI) — and it does so under HIPAA, which turns a breach into both a notification event and a potential regulatory action. Cyber liability insurance is the only line that responds, because standard GL and BOP policies contain absolute cyber exclusions.
A standalone cyber policy covers both sides of an incident:
- First-party — forensic investigation, breach notification to affected patients (required by law in all 50 states), credit monitoring, ransomware/extortion costs, and business interruption while systems are down.
- Third-party — privacy liability for compromised PHI, network security liability, and — critically for healthcare — regulatory defense and fines, including HIPAA investigations.
Carriers increasingly require specific controls before they will quote: multi-factor authentication (MFA), endpoint detection and response (EDR), and regular backups. A practice without MFA may be declined outright, so getting those controls in place before applying is part of the process. See the cyber hub for the field.
Commercial auto and hired/non-owned auto — if anyone drives for the practice
Not every practice needs commercial auto, but any practice with a titled vehicle — a mobile or home-visit provider, a courier that runs specimens to a lab — does, because it is required by law for any vehicle registered to a business entity, and personal auto excludes business use. The more common and more overlooked exposure is hired and non-owned auto (HNOA): staff running to the pharmacy, the lab, or the bank in their own cars puts the practice on the hook, and that gap is only filled by the right auto symbols or an HNOA endorsement — which can often be added to the BOP. The commercial auto hub covers the market.
How much does it cost?
There is no flat price for medical practice insurance — every line is quote-based and driven by the specifics of your practice. What moves the number is consistent across carriers:
- Payroll drives workers' comp directly, split across clinical and clerical class codes, then adjusted by your EMR.
- Patient revenue and the number of providers are the primary rating basis for malpractice and general liability — more providers and more billings mean more exposure.
- Specialty and procedures shape the malpractice premium heavily; the risk profile of what you actually do dominates the rate.
- Claims and loss history matter on both sides — prior malpractice claims on the professional line, and your EMR on the comp line.
- Location counts, since litigation environment and state rules vary; more litigious states push the professional and GL lines higher.
- Data exposure and security posture drive cyber — how many patient records you hold and whether you have MFA, EDR, and backups in place.
- Property values (equipment, tenant improvements) set the property side of the BOP.
General liability on its own can start low for a small office-based practice, but it is only one line in a program that is dominated by malpractice — so the total is best treated as a quote to gather, not a figure to guess. Because the same practice can see materially different quotes from different carriers, comparing more than one is worth the effort.
Best insurers for medical practices
These four cover the distinct parts of a practice's program. None is a one-size-fits-all pick — match each to the exposure it fits best.
Hiscox — best for the professional-liability and office (BOP) foundation
Hiscox is a specialty small-business insurer whose calling card is professional liability (E&O), and it also writes general liability, BOP, and cyber, sold direct and online with real-time BOP quoting (available in 43 states plus DC). For a practice, Hiscox is the benchmark to compare on the professional-services and office side of the program — the GL and BOP foundation and professional-liability depth. One gap to note: Hiscox does not write commercial auto, so a practice with vehicles needs that elsewhere.
Embroker — best for packaging multiple professional and management lines
Embroker is a digital commercial insurance brokerage and platform that packages coverage by industry — pairing a broker's guidance with online quoting across BOP, general liability, professional liability (E&O), D&O, EPLI, cyber, and crime. For a practice organized as a group or professional corporation that wants several lines coordinated — professional and management liability alongside a BOP and cyber — Embroker's broker-plus-platform model fits, and it is particularly known for management liability like D&O. Per its own site it has served customers for 10 years and secured 16,000+ policies; it is a brokerage, not a carrier.
Coalition — best for cyber and PHI exposure
Coalition is the category leader in cyber, built around what it calls Active Insurance — coverage bundled with security technology that monitors, alerts, and responds, rather than a bare policy. For a practice whose single biggest data exposure is the PHI it holds under HIPAA, that combination is the right shape: the policy covers first-party breach response and third-party regulatory defense, while the bundled Coalition Control platform, continuous monitoring, and Wirespeed MDR help prevent the incident and satisfy the security controls carriers now require. Coalition distributes through appointed brokers rather than direct.
Gravie — best for health benefits for your own staff
Gravie covers a different need than the P&C lines above: benefits for the practice's own employees. It is a small-business health benefits platform best known for its Comfort plan — a level-funded plan that covers most common care at $0 to members (94% of office visits at no cost last year) — and Gravie ICHRA, a reimbursement arrangement for employers who want flexibility. For a practice competing to retain nurses and clinical staff, offering a strong health plan is part of the picture; Gravie reports 97% employer satisfaction. It is a benefits platform, not a P&C insurer. Compare the field on the health & benefits hub.
For the broader landscape of these providers, see the small-business insurtech hub.
Frequently Asked Questions
Does general liability cover a malpractice claim against my practice?
No. General liability explicitly excludes professional services errors. It covers third-party bodily injury and property damage — a patient slipping in your waiting room, for example — but a claim that diagnosis or treatment caused harm is a medical malpractice claim, which falls under professional liability (E&O). Every practice needs both, because they cover different things.
Why does a medical practice need cyber insurance specifically?
Because a practice stores protected health information (PHI) under HIPAA, and standard GL and BOP policies contain absolute cyber exclusions — they do not respond to a data breach at all. A standalone cyber policy pays for breach notification, forensics, business interruption, and — importantly for healthcare — regulatory defense and fines from HIPAA actions. A small cyber sub-limit endorsed onto a BOP covers only a fraction of a real breach.
What is "claims-made" and why does the retroactive date matter for malpractice?
Malpractice is almost always written on a claims-made basis, meaning the policy must be active when the claim is filed, not just when the care was delivered. The retroactive date is the earliest date from which claims are covered — care before it is excluded — so you want the earliest possible retroactive date and should preserve it when switching carriers. If you cancel or retire, tail coverage extends the reporting window so future claims about past care are still covered.
How much does insurance for a medical practice cost?
There is no flat price — every line is quote-based. Malpractice and general liability are driven mainly by patient revenue, provider count, and specialty; workers' comp is driven by payroll and your experience modification rate; and cyber is driven by how much PHI you hold and your security controls. Location and claims history move all of them. Because the same practice can see materially different quotes from different carriers, comparing more than one is worth the time.
The bottom line
A medical practice needs a program, not a policy. The clinical exposure lives in medical malpractice (professional liability), the premises and equipment in a general liability / BOP foundation, the staff in workers' comp, and the PHI you hold under HIPAA in a standalone cyber policy — with commercial auto or an HNOA endorsement if anyone drives for the practice. On the provider side, Hiscox and Embroker anchor the professional and business lines, Coalition is the cyber benchmark for PHI exposure, and Gravie handles benefits for your own staff. Every premium is quote-based, so gather more than one and compare the coverage, not just the price.
