Insurance for Medical and Dental Practices in California

A California medical or dental practice usually needs six things: professional liability (malpractice), a property and general liability package, cyber coverage that handles HIPAA breach costs, employment practices liability, workers' compensation, and business income coverage. Malpractice is the largest and most specialized piece, and it's normally placed with a carrier or trust that focuses on healthcare. Everything else is the same kind of commercial coverage any office-based business buys, with a few healthcare-specific twists.

TSM's role is to help coordinate the whole program. We work alongside your malpractice carrier and write or place the business coverages around it so the policies fit together without gaps or overlaps. Our healthcare and medical practice insurance page covers the practice types we work with.

Medical professional liability (malpractice)

Malpractice covers claims that your clinical care injured a patient. For a physician or dentist it's the coverage that matters most, and it's different from general liability: GL covers a patient slipping in the waiting room, and malpractice covers a missed diagnosis. The distinction is explained further in general liability vs. professional liability.

How malpractice is placed

Most practices buy malpractice from carriers, risk retention groups or physician-owned trusts that specialize in medical liability. TSM does not claim to write malpractice directly. What an independent agent can do is:

• Make sure the entity (your professional corporation or group) is insured, not just the individual providers.

• Check that employed providers and staff, such as nurse practitioners, physician assistants, hygienists and medical assistants, are covered under the practice's policy or their own.

• Line up the malpractice policy with your general liability, cyber and EPLI so the overlaps and exclusions are understood.

• Track renewal dates, tail obligations and contract requirements from hospitals, surgery centers and payers.

Claims-made, tail and prior acts

Most medical malpractice is written on a claims-made basis. The policy that responds is the one in force when the claim is made, not when the treatment happened. That has two consequences:

• When you change carriers, you need the new policy to include prior acts (a retroactive date that reaches back), or the old carrier's extended reporting period ("tail"), to cover claims about past care.

• When a provider leaves or retires, someone has to arrange tail coverage. Employment contracts should say who pays for it.

Our explainer on claims-made vs. occurrence policies covers retroactive dates and tails in more detail.

MICRA and AB 35: the current caps

California has capped non-economic damages (pain, suffering and other non-monetary losses) in medical negligence cases since the Medical Injury Compensation Reform Act (MICRA) of the 1970s. For decades the cap was a fixed amount. AB 35 (Stats. 2022, Ch. 17) rewrote Civil Code §3333.2 for cases filed or arbitrations demanded on or after January 1, 2023:

• Injury cases (not wrongful death): $350,000 in 2023, rising $40,000 each January 1 for 10 years to $750,000.

• Wrongful death cases: $500,000 in 2023, rising $50,000 each January 1 for 10 years to $1,000,000.

• From January 1, 2034, both amounts increase by 2% a year for inflation.

Year (effective Jan 1)	Injury (non-death) cap	Wrongful death cap
2023	$350,000	$500,000
2024	$390,000	$550,000
2025	$430,000	$600,000
2026	$470,000	$650,000
2027	$510,000	$700,000
2033	$750,000	$1,000,000

Under §3333.2(g), the amount in effect at the time of judgment, arbitration award or settlement applies. A claim filed in 2026 but resolved in 2028 uses the 2028 figure.

AB 35 also created separate caps for different categories of defendant. These are one cap for health care providers collectively, one for health care institutions collectively, and one for unaffiliated providers or institutions whose separate negligence occurred at, or in transport to, an unaffiliated institution. So a single claim can involve up to three non-economic caps, not one (§3333.2(b)–(f)). The statute's definition of "health care provider" covers people licensed under Division 2 of the Business and Professions Code. That includes physicians and dentists, as well as the provider's professional corporation or practice organization.

What this means for limits: the caps apply only to non-economic damages. Economic damages, such as medical costs, lost earnings and future care, are not capped and drive the largest verdicts. Rising caps put upward pressure on claim values. Review your limits at every renewal rather than carrying the number you chose years ago.

Property and general liability (often a BOP)

Many smaller practices can package property and general liability in a business owner's policy (BOP). Larger practices or those with expensive imaging equipment often need separate commercial property and GL policies. Points specific to medical and dental offices:

• Equipment values. Dental chairs, CBCT and digital imaging, lasers, sterilizers and EHR hardware add up quickly. Insure at replacement cost and update values when you buy equipment.

• Equipment breakdown. Electrical or mechanical failure of an autoclave, compressor, imaging unit or HVAC system is typically excluded from basic property coverage unless equipment breakdown is added.

• Vaccines, biologics and temperature-sensitive medications can be lost to a power outage or refrigeration failure. Spoilage coverage is often a limited add-on. Check the sublimit against what's actually in your refrigerators.

• Tenant improvements. If you lease, your lease often makes you responsible for the build-out. Insure it.

• Valuable papers and records. Restoring paper charts or records after a fire or flood is expensive. Check whether there's a sublimit.

Business income

If a fire, burst pipe or smoke damage closes your office, patients don't wait. They go elsewhere. Business income insurance typically replaces lost net income and continuing expenses, including payroll, rent and loan payments, during the restoration period after covered physical damage. Extra expense coverage pays for things like temporary space or equipment rental to keep seeing patients.

For practices, check:

• The limit against current collections, not revenue from three years ago.

• Whether ordinary payroll is included, and for how long. Keeping trained staff during a closure is usually the point.

• The extended period of indemnity, which covers the ramp back to normal patient volume after you reopen.

• Dependent property coverage if you rely heavily on a single hospital, surgery center or lab.

Want your malpractice and business coverage reviewed together? TSM is an independent agency — we compare carriers for you. Call (209) 524-6366 (Modesto) or (530) 221-3031 (Redding).

Cyber insurance and HIPAA breach costs

Healthcare records are a frequent target for ransomware and theft. A medical or dental practice has notification duties under several laws at once:

Law	Who it covers	Key requirement
HIPAA Breach Notification Rule (45 CFR §§164.404–164.408)	Covered entities (most practices that bill electronically)	Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. For breaches of 500+ residents of a state, notify prominent media. For 500+ individuals, notify HHS at the same time as individuals. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year.
Civil Code §1798.82	Businesses that own or license computerized personal information of California residents	Notify within 30 calendar days of discovery, subject to law-enforcement and scoping delays, using the "Notice of Data Breach" format
Confidentiality of Medical Information Act (Civil Code §56.36)	Providers handling medical information	A patient can recover $1,000 nominal damages for a negligent release without proving actual damages, plus actual damages. Administrative fines or civil penalties can also apply.
Health & Safety Code §1280.15	Clinics, health facilities, home health agencies and hospices licensed under §§1204, 1250, 1725 or 1745	Report unauthorized access to the California Department of Public Health and the patient within 15 business days of detection. Penalties up to $25,000 per patient.

Whether §1280.15 applies to your practice depends on whether you operate a state-licensed clinic or facility. Many physician-owned offices are not licensed clinics. Your healthcare attorney can confirm which rules apply to you.

A cyber insurance policy for a practice should typically include:

• Breach response: forensics, legal counsel, notification mailing, call centers and credit monitoring.

• Ransomware and cyber extortion, including negotiation and payment where lawful.

• Business interruption from a system outage, which property policies typically don't cover. A practice that can't access its EHR or scheduling can't bill.

• Data restoration.

• Regulatory defense and penalties where insurable, including HIPAA and state proceedings.

• Privacy liability for patient lawsuits, including CMIA claims.

• Funds transfer fraud and social engineering, sometimes on the cyber policy and sometimes on a crime and employee theft coverage Confirm where yours sits.

Read the requirements in the application and policy carefully. Many carriers now condition coverage on controls such as multi-factor authentication and backups. A misstatement on the application can jeopardize a claim.

Employment practices liability (EPLI)

Medical and dental offices have a lot of employees per square foot, many of them hourly. California's Fair Employment and Housing Act generally applies to employers with five or more employees (Gov. Code §12926(d)). Discrimination, harassment, retaliation and wrongful termination claims are a regular exposure for practices. Employment practices liability (EPLI) typically pays defense costs and settlements for those claims. Points to check:

• Wage-and-hour claims (overtime, meal and rest breaks) are typically excluded or covered only for defense costs under a small sublimit. They're a significant exposure for practices with hourly staff.

• Third-party coverage for harassment claims by patients or vendors.

• Retention (deductible) and whether you must use the carrier's panel counsel.

Workers' compensation

Every California employer must carry workers' comp (Labor Code §3700). Clinical staff face needlestick and bloodborne-pathogen exposures, lifting injuries from patient handling, and repetitive-motion injuries in dental and front-office work. Premium is based on payroll by classification and your experience modification. See our workers' comp guide for California employers.

A note on physicians and dentists who work as contractors: Labor Code §2783(b) exempts licensed physicians, dentists, podiatrists, psychologists and veterinarians providing services to or by a health care entity from AB 5's ABC test. Their status is decided under the older Borello test instead. That exemption doesn't automatically make a contracted provider an independent contractor. Have the arrangement reviewed.

Other coverages to consider

• Crime / employee dishonesty. Front-desk staff handle copays and deposits. Embezzlement in medical and dental offices is a recognized risk.

• Commercial auto or hired and non-owned auto, if staff run errands, transport specimens or drive to other facilities.

• Umbrella, which typically sits over GL, auto and employer's liability. It generally does not sit over malpractice, which needs its own higher limits.

• Group health benefits for staff. Our small-business group health insurance page explains the options.

Medical and dental practice insurance checklist

• ☐ Malpractice for every provider and for the entity, with limits that satisfy hospital, ASC and payer contracts

• ☐ Retroactive date preserved, and tail responsibility written into provider contracts

• ☐ Property at replacement cost, including equipment and tenant improvements

• ☐ Equipment breakdown and spoilage with adequate sublimits

• ☐ Business income with ordinary payroll and an extended period of indemnity

• ☐ Cyber with breach response, ransomware, business interruption and regulatory coverage

• ☐ EPLI, with the wage-and-hour position understood

• ☐ Workers' comp, with contractor arrangements reviewed

• ☐ Crime coverage for cash handling and funds transfer fraud

• ☐ Umbrella over the non-malpractice liability lines

FAQs

What insurance does a medical practice need in California?

Typically malpractice (medical professional liability), property and general liability (often a BOP), business income, cyber with HIPAA breach coverage, EPLI and workers' compensation. Workers' comp is legally required once you have employees (Labor Code §3700).

What is the MICRA cap in California in 2026?

For cases governed by AB 35, the non-economic damages cap is $470,000 for injury cases and $650,000 for wrongful death cases as of January 1, 2026. These rise by $40,000 and $50,000 each January 1 until they reach $750,000 and $1,000,000, and then grow 2% a year from 2034. Separate caps can apply to providers, institutions and unaffiliated defendants.

Does MICRA apply to dentists?

Yes. Civil Code §3333.2 defines "health care provider" to include people licensed under Division 2 of the Business and Professions Code, which includes dentists, and the practice entity they work through.

Does general liability cover malpractice?

No. General liability typically excludes professional services. Malpractice is a separate policy, usually from a carrier that specializes in medical liability.

Is a HIPAA breach covered by insurance?

Cyber insurance typically covers breach response costs: forensics, notification, credit monitoring and legal counsel. Many policies also cover regulatory defense and some penalties where insurable by law. Property and general liability policies typically don't.

How long does a medical practice have to report a data breach?

Under HIPAA, notify affected individuals within 60 calendar days of discovery at the latest. California's general breach law sets 30 calendar days for notifying residents, subject to limited delays, and licensed clinics and facilities have a 15-business-day reporting duty under Health & Safety Code §1280.15.