6 risks that can leave medical practices more exposed than they realize

A medical practice can carry insurance and still have a serious gap hiding in plain sight. In Jarrell v. Kaul, a patient sued after complications from a spinal fusion performed by Dr. Parvez Kaul. A jury found that Kaul negligently performed the procedure and awarded $500,000 to the patient and $250,000 to his wife. Yet the insurance issue did not end with the malpractice verdict. Kaul had a malpractice policy at the time, but it expressly excluded spinal surgery, leaving him uninsured for the procedure at the center of the case. The New Jersey Supreme Court also held that the surgical center where he performed the procedure could face a negligent hiring claim based on its duty to ensure physicians using its facility maintained the required malpractice coverage or a suitable letter of credit.

The lesson for medical practices is direct: coverage cannot be evaluated by the existence of a policy alone. A practice also needs to know whether the policy matches the procedures, providers, locations and business risks that could generate the loss. Insurance may exist on paper, yet fall short when a claim involves an excluded procedure, a narrow trigger, a sublimit, a reporting requirement, a timing issue or a business impact the policy does not address.

That distinction has become more important as practices face rising liability costs, cyber disruption, staffing pressure, employee claims, revenue interruptions and reputational threats. Each can create financial strain even when the practice has purchased commercial insurance.

Malpractice coverage gaps

Medical malpractice insurance remains essential, but practice leaders should avoid assuming that every provider, procedure, location or service line falls within the policy. The Jarrell case shows how a physician can carry malpractice coverage while lacking protection for the procedure at issue. Practices also need to watch prior acts coverage, tail coverage, consent-to-settle provisions, policy limits and exclusions that may apply when physicians join, leave, retire, expand services or work across multiple entities.

Cost pressure remains a concern. The American Medical Association’s 2026 analysis found that medical liability premiums rose for the seventh consecutive year in 2025, the longest upward streak since 2005. Although the share of premiums that increased fell from 49.8% in 2024 to 39.9% in 2025, only 3.1% decreased, and large premium increases of 10% or more occurred in 11 states.

Cyber disruption

Medical practices depend on electronic health records, billing systems, scheduling platforms, payment portals and third-party vendors to keep revenue moving. A cyber event can interrupt patient care, delay claims submission, disrupt prior authorizations and slow cash collections. The 2024 Change Healthcare cyberattack showed how a vendor incident can affect providers across the country. The Office of Financial Research reported that many providers using Change Healthcare could not submit medical claims or receive payments during the outage, straining cash flows.

Cyber coverage can fund breach counsel, forensics, notification, restoration and certain business interruption losses. However, policies often include security requirements, exclusions, waiting periods, sublimits and notice obligations. A small cyber endorsement attached to another policy may not cover lost revenue, vendor disruption, patient communication costs and reputational harm.

Employment practices claims

Medical practices operate as clinical businesses and employers. Physicians, nurses, medical assistants, billing staff, front desk employees, contractors and administrators work in high-pressure environments where staffing shortages and patient demands can increase conflict. Claims involving discrimination, retaliation, harassment, wage disputes, disability accommodations or wrongful termination can create legal expenses and operational disruption even when the practice believes it acted appropriately.

Employment practices liability insurance can help, but practices need to know when a potential claim becomes reportable. An employee complaint, demand letter or administrative charge may trigger notice requirements before a lawsuit exists. If the practice waits too long, it could lose coverage and end up absorbing legal costs and management disruption.

Business interruption

Practice leaders often think of business interruption coverage as protection for lost revenue whenever operations stop. Many policies operate more narrowly. The National Association of Insurance Commissioners explains that business interruption insurance generally helps businesses recover monetary losses during suspended operations when a covered event, such as a fire, causes physical property damage.

That structure can leave practices exposed when revenue disruption comes from a cyber incident, vendor failure, payer disruption, utility outage, physician absence or loss of access to a facility without covered property damage. Even when coverage applies, the practice may need liquidity long before payment arrives.

Reputation damage

Reputation risk can create a difficult coverage gap because the financial loss often extends beyond what a policy can measure. A malpractice allegation, billing dispute, employee lawsuit, data incident, negative review campaign or public complaint can affect patient trust before any formal finding determines responsibility. It can also influence whether referring physicians continue sending patients, whether new patients schedule appointments and whether current patients stay with the practice.

That exposure is difficult to insure cleanly. A policy may cover defense costs, privacy response expenses or limited crisis communications support, but it rarely replaces lost referrals, lower appointment volume, reduced patient acquisition or the time required to rebuild confidence. That gap has become more significant as patients rely more heavily on online information when choosing providers. RepuGen’s 2025 Patient Review Survey found that 73.28% of patients consider online reviews when selecting a provider.

Short-term disability and key physician absence

A physician’s disability policy may protect the physician’s personal income, but it may do little to protect the practice’s revenue. If a key surgeon, specialist or high-producing physician cannot work for several weeks or months, the business may face canceled appointments, temporary physician staffing costs, referral leakage, underused staff and reduced ancillary revenue.

Traditional insurance may not fully address that loss because the practice’s exposure is operational as much as financial. During an extended absence, leaders still have to maintain patient volume, preserve referral relationships, cover fixed expenses and prevent patients from moving to competitors while the physician is out.

Closing the gap between coverage and exposure

Medical practices cannot eliminate every retained risk, but they can manage those risks with more discipline. That starts with a coverage review that connects policy language to realistic operating scenarios. Leaders should examine exclusions, sublimits, deductibles, waiting periods, notice requirements and coverage triggers across malpractice, cyber, EPLI, property, business interruption, disability and other policies.

Practices should also model which events could affect cash flow within 30, 60 or 90 days, which losses may fall below deductibles or above sublimits and which disruptions could continue while a claim remains unresolved. That analysis can guide reserves, vendor redundancy, employment practices training, incident response planning, contract terms, communications protocols and physician transition planning.

Some practices may also consider alternative risk financing. Depending on size, profitability, claims history and risk profile, options may include higher deductibles, formal reserves, risk retention groups, contractual risk transfer or captive insurance. A captive can help a qualifying practice finance certain retained risks, build reserves and track losses more intentionally. It should complement strong commercial coverage, not replace it.

Insurance gives medical practices an important financial backstop, but policies cannot address every exposure with the speed or completeness leaders may expect. Practices that understand their retained risks can make clearer decisions about coverage, liquidity and long-term resilience before a claim tests the difference.

Randy Sadler started his career in risk management as an officer in the U.S. Army, where he was responsible for the training and safety of hundreds of soldiers and over 150 wheeled and tracked vehicles. He graduated from the U.S. Military Academy at West Point with a Bachelor of Science degree in International and Strategic History with a focus on U.S. – Chinese Relations in the 20th century. He has been a Principal with CIC Services, LLC for 8 years and consults directly with business owners, CEOs, and CFOs in the formation of captive insurance programs for their respective businesses. CIC Services, LLC manages over 200 captives.