Every clinic needs professional liability for the people who treat patients. General liability matters wherever patients are physically present: a clinic, a rented room, a home visit or an event. Cyber matters most for telehealth and anyone holding records online. Auto and workers’ compensation depend on whether staff drive and how many you employ. And your medical director’s policy covers the director, not your staff.
Each side insures its own acts
This is the question operators ask most often: does the medical director’s fee include malpractice coverage for my injectors? In the structure MDside uses, no. The practice insures itself and its physicians. The operator insures its own business, its owners and every clinician or delegate it employs or engages. The operator’s policies then name the practice and MDside as additional insureds where the carrier allows it.
The reason is simple. A physician’s policy is written for that physician. It doesn’t automatically extend to a nurse, an esthetician or a medical assistant working under delegation, and it doesn’t cover the business. How individual and entity coverage differ, and why the tail matters, is at medical director malpractice insurance.
The coverages, in plain terms
- Professional liability (malpractice) covers claims that clinical work caused harm. The industry also calls it errors and omissions [III, professional liability].
- General liability covers bodily injury and property damage that happen on your premises or from your business operations: the slip in the hallway, the damaged furniture in a rented suite [Texas Department of Insurance]. Standard policies often exclude professional liability, so one doesn’t replace the other [III, commercial general liability].
- Cyber liability pays for responding to a data breach. HIPAA requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery [45 CFR 164.404]. A breach affecting more than 500 residents of a state also requires notice to prominent media outlets [45 CFR 164.406]. That response is expensive, and cyber coverage is how most small practices pay for it. More at HIPAA for med spas.
- Hired and non-owned auto covers liability when an employee’s own car, or a rented one, is used for the business [IRMI]. A nurse driving to a home visit is the textbook case.
- Workers’ compensation is the one coverage on this list that state law commonly requires, and the threshold varies. Florida requires it for most employers with four or more employees [Florida DWC]. Alabama requires it at five or more employees for most businesses [Alabama DOL]. Texas lets private employers choose [Texas DOI].
Required coverage by setting
| Setting | Professional liability | General liability | Cyber | Auto | Notes |
|---|---|---|---|---|---|
| Brick and mortar clinic or med spa | Required | Required | If you keep records or book online | Not usually | The landlord’s lease often sets its own general liability requirement |
| Room or suite inside another business | Required | Required | If you keep records or book online | Not usually | The host’s rental agreement usually requires your own general liability, naming the host |
| Mobile, in-home or event | Required | Required | If you keep records or book online | Hired and non-owned auto at minimum | Product and equipment travel with you. See mobile IV structure and event IV |
| Telehealth only | Required | Low exposure without a patient-facing site. Required if you ship products | Required | No | Data is the main non-clinical exposure |
| Hybrid (telehealth plus any in-person setting) | Required | Required | Required | If mobile | Apply the requirements of every setting you use |
| Management company only (no clinical staff) | Not usually | If it has an office open to the public | If it handles patient information | No | Its exposure is operational. See friendly PC and MSO structure |
Workers’ compensation applies across every row according to your state and headcount.
Limits are a contract term, mostly
State law rarely dictates how much coverage a clinic carries. We found no state law requiring general liability or cyber coverage for a medical practice or management company. For physicians, a few states set malpractice minimums. New Jersey requires physicians to carry coverage at a set per-occurrence and annual amount, or a letter of credit if coverage isn’t available, with tail coverage for claims-made policies [N.J.S.A. 45:9-19.17; N.J.A.C. 13:35-2B.17]. Florida sets lower financial responsibility amounts, higher with hospital privileges, and lets physicians who meet conditions go without coverage if they post a patient notice [Fla. Stat. § 458.320].
Everywhere else, the limits come from the agreements you sign: the director agreement, the management agreement, the lease and any host-facility contract. Set them once, the same for every client, and write them into the agreement. The clause list for a director agreement is at medical director agreement checklist.
Terms to put in the agreement
- Who insures whom. Each party insures its own acts. The operator covers every clinician and delegate it engages.
- Additional insureds. The operator’s general liability, cyber and auto policies name the practice and the management company. Professional liability names them where the carrier allows it. Where it doesn’t, get a carrier letter confirming the delegated services are covered.
- Claims-made policies. A claims-made policy covers claims reported during the policy term. An occurrence policy covers events that happen while it is in force [Texas DOI, medical malpractice]. If a policy is claims-made, the agreement should require tail or prior-acts coverage when it ends.
- Scope. The policy must list the services actually performed. Device treatments, IV therapy and delegation to unlicensed staff are common gaps.
- Certificates and notice. Certificates before the first patient and at each renewal, and written notice before any cancellation or reduction.
- Change of setting. An operator that adds a setting, such as a telehealth practice opening a room or starting home visits, adds that setting’s coverage before the first patient there.
What this means for you
List every setting where your staff see patients, including the ones you’re planning, and match each to the table above. Buy professional liability that names every clinician and every service on your menu. Don’t assume the director’s policy reaches your staff. Add general liability wherever patients are physically present, cyber if you hold records online, and non-owned auto if anyone drives to patients. Then ask your broker for certificates naming your practice and management partners as additional insureds, and keep the declarations pages on file.
Related reading
Frequently asked questions
Does a medical director’s malpractice insurance cover the med spa’s staff?
Usually not. A physician’s policy is written for that physician and doesn’t automatically extend to nurses, estheticians or medical assistants, or to the business itself. The clinic should carry its own professional liability covering every clinician and delegate, naming the practice and management company as additional insureds where the carrier allows.
What insurance does a mobile IV business need?
Professional liability for the nurses and every service offered, general liability because care happens in homes and at events, and hired and non-owned auto because staff drive to patients. Add cyber coverage if you keep patient records or book online, and workers’ compensation according to your state’s employee threshold.
Does a telehealth-only business need general liability insurance?
Its exposure is lower, because patients never visit a site. Professional liability and cyber coverage matter most for a telehealth-only business. General liability still makes sense if you ship products to patients, keep an office open to visitors, or a contract or lease requires it.
What is the difference between general liability and professional liability?
Professional liability covers claims that clinical care caused harm. General liability covers bodily injury and property damage from your premises or business operations, such as a fall in the waiting room. General liability policies often exclude professional services, so a clinic needs both.
Is malpractice insurance required by law for physicians?
In a few states. New Jersey requires physicians to carry coverage at statutory minimums or post a letter of credit. Florida sets financial responsibility minimums and allows a posted-notice opt-out for physicians who qualify. Most states set no minimum, and the requirement comes from hospitals, carriers and contracts.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.