This guide is about insuring your practice as a business, meaning the malpractice, liability, cyber and employer policies a new direct primary care clinic carries. If you are looking for the health insurance your patients should pair with a DPC membership, read what insurance to pair with DPC instead.
What insurance does a new DPC practice need?
A new DPC practice usually needs professional liability (malpractice) coverage for every clinician, general liability and property coverage (often bundled into a business owner's policy), cyber liability, and workers' compensation once it hires staff in a state that requires it. Many practices also add employment practices liability, business interruption coverage and an umbrella policy as they grow. Some states require malpractice coverage by law, so check your licensing board before you see your first patient.
Insurance is one line in the larger startup budget, and it is easy to leave until the last week because the quotes take time. If you are still mapping the whole launch, start with how to start a DPC practice and how much it costs to start a DPC, then come back here to build the coverage list.
This article is general information, not insurance or legal advice. Policy terms, state rules and carrier appetite vary, so confirm every decision with a licensed broker and, for state requirements, your medical board.
The coverage list at a glance
Here is the full set of policies most new DPC owners discuss with a broker, with what each one does and when it matters.
| Coverage | What it protects | When you need it | Notes |
|---|---|---|---|
| Professional liability (malpractice) | Claims that your clinical care injured a patient | Before your first patient, for every clinician | Required by law in some states. Choose claims-made or occurrence. |
| Tail or prior-acts coverage | Claims from your previous job filed after you leave | When you leave a claims-made policy | Check your employment contract for who pays. |
| General liability | Slip-and-fall injuries and other non-clinical claims on your premises | Before you open the doors | Landlords usually require proof. |
| Commercial property | Your equipment, furniture, inventory and build-out | Before equipment arrives | Often bundled with general liability. |
| Business owner's policy (BOP) | General liability plus property in one package | Before opening | Usually the simplest way to buy the two above. |
| Cyber liability | Breach response, notification, ransomware, data restoration | Before you store patient data | Sometimes included as a small sublimit in a malpractice policy. |
| Workers' compensation | Employee work injuries and illnesses | Before your first employee starts | Required in most states, with state-specific thresholds. |
| Employment practices liability (EPLI) | Claims of discrimination, harassment or wrongful termination | When you hire | More important as the team grows. |
| Business interruption | Lost income and ongoing costs after a covered shutdown | Before opening | Often an add-on to a BOP. |
| Umbrella | Extra liability limits above your underlying policies | Once you have assets or employees to protect | Usually does not extend over malpractice. |
Malpractice insurance for direct primary care
Professional liability is the policy that matters most, and it is the one with the most DPC-specific questions. The practice model changes your risk profile in ways a standard primary care policy may not anticipate. You see fewer patients, spend more time with each one, and are reachable by text and phone, but you may also dispense medications, run point-of-care labs, do home visits and practice by telemedicine, all of which a policy needs to name.
Do DPC physicians pay less for malpractice?
Sometimes, according to the brokers and programs that sell DPC coverage, but there is no independent published study that proves it. The evidence available is what the sellers say about their own programs, and it is worth reading with that in mind.
MyDPCInsurance.com, listed as a premier sponsor of the Direct Primary Care Alliance, describes itself as the administrator of a DPC-specific malpractice policy and says that "most practices enjoy up to 30% discount compared to traditional marketplace insurers," with discounts depending on location and other criteria (DPC Alliance sponsor listing). The same listing says coverage options include telemedicine, home visits and compounded medications.
The national broker Cunningham Group says it has worked with carriers to show that DPC and concierge physicians are lower risk, and that physicians who shop through it typically save 20 to 40 percent. It also notes that the A-rated carrier behind its first national DPC program ended that program in 2021, which is a useful reminder that specialty programs can come and go (Cunningham Group).
The practical move is to get quotes from at least one DPC-specific program and one or two standard carriers, and compare the policy forms, not just the premium. Ask whether the policy is written for a membership practice, whether it names the services you actually provide, and whether it includes extras like regulatory defense or a cyber sublimit.
How much does DPC malpractice cost?
We did not find a current, freely accessible source that publishes DPC malpractice premiums, so this guide does not list a number. Premiums depend heavily on your state, county, specialty classification, claims history, limits and policy type, and the published industry rate surveys are behind a paywall. Your broker can pull quotes for your exact ZIP code, which is the only number that matters for your budget.
Claims-made vs occurrence, and why tail coverage matters
Malpractice policies come in two main forms. A claims-made policy covers claims that are made while the policy is in force (for incidents after its retroactive date), so if you cancel it, incidents from those years are no longer covered unless you buy tail coverage, formally an extended reporting endorsement. An occurrence policy covers any incident that happened during the policy period, no matter when the claim is filed, so there is nothing to buy when you leave.
Claims-made premiums usually start lower and step up over the first several years, which is why so many new practices choose them. The tradeoff shows up at the exit. The American College of Physicians notes that tail coverage is a one-time cost that can run 1.5 to 2 times a typical annual premium (ACP). Some insurers waive or discount the tail at retirement after a number of continuous years, as the Massachusetts malpractice insurance FAQ describes.
This matters on the way in, too. If you are leaving an employed position that carried a claims-made policy, you need either a tail from that policy or prior-acts (sometimes called nose) coverage from your new DPC carrier. Read your employment contract before you give notice, since it usually says who pays. If you are converting an existing practice, the same question applies to your current policy, which we cover in converting a practice to direct primary care.
Which states require malpractice coverage?
Most states do not require physicians to carry malpractice insurance, but some do, and the rules set minimum limits. Two examples we verified in state sources:
- New Jersey requires a physician who maintains a practice in the state and has responsibility for patient care to carry malpractice coverage, including tail coverage for claims-made policies, or a letter of credit if coverage is not available (N.J.S.A. 45:9-19.17).
- Connecticut requires licensees who provide direct patient care to maintain professional liability insurance or other indemnity, and the medical board can restrict or suspend a license for failing to keep it (Connecticut DPH, C.G.S. 20-11b).
New Jersey's statute sets the minimum at 1 million dollars per occurrence and 3 million dollars per policy year, or a letter of credit of at least 500,000 dollars. Connecticut's minimum is 500,000 dollars per occurrence with a 1.5 million dollar aggregate.
Other states tie coverage to patient compensation funds or financial responsibility rules, and those details change. Check your own medical board before opening, and see our DPC laws by state guide for the membership-specific rules that sit alongside them.
Dispensing, labs and telemedicine need to be on the policy
If you plan to dispense medications or run in-house labs, tell your carrier up front and make sure the policy covers it. The same goes for compounded medications, home visits and visits by video across state lines. These services are a big part of the DPC value proposition, and they are exactly where a generic primary care policy may be silent. Our guide to DPC dispensing, medications and labs covers the regulatory side of dispensing.
General liability and a business owner's policy
General liability covers injuries and property damage that are not about clinical care, like a patient slipping on a wet floor in your waiting room. Commercial property covers your exam tables, computers, lab equipment, dispensary inventory and any build-out you paid for. The U.S. Small Business Administration describes a business owner's policy (BOP) as a package that bundles these common coverages, and for a small clinic it is usually the simplest way to buy them.
Your landlord will almost certainly ask for a certificate of general liability insurance before you get the keys, often with the landlord named as an additional insured. Ask your broker to read the lease's insurance section with you, because it often sets the limits you need. If you practice out of a shared space or a micro-suite, confirm whether the building's coverage protects your equipment (it usually does not).
Medical practice cyber insurance
A DPC clinic runs on email, texting, an EHR, a billing platform and usually a payment processor, so a stolen laptop, a phishing email or ransomware can stop the practice and expose patient data. Cyber liability insurance typically pays for breach response, forensic investigation, notification, credit monitoring for affected patients, data restoration and, depending on the policy, lost income during downtime.
The federal HIPAA Breach Notification Rule (45 CFR 164.400-414) requires covered entities and their business associates to notify affected individuals after a breach of unsecured protected health information, and to notify HHS. Breaches affecting 500 or more people also require notice to prominent media and prompt notice to HHS, which is where costs climb fast.
A cash-only DPC practice raises a fair question here. HHS defines a covered health care provider as one that transmits health information electronically in connection with standard transactions such as insurance claims (HHS covered entities), so some DPC practices that never bill insurance may fall outside HIPAA. Most still follow HIPAA practices, because state breach notification laws apply regardless and patients expect it.
Some DPC malpractice programs include a small cyber sublimit. The DPC Alliance sponsor listing above, for example, describes a separate cyber limit included at no added charge.
That listing puts the cyber sublimit at $100,000.
Ask whether a sublimit like that is enough for your patient count, or whether a standalone cyber policy with higher limits and ransomware coverage makes more sense.
Workers' compensation for a DPC clinic
Workers' compensation covers medical care and lost wages for employees who are hurt or get sick because of their job, such as a medical assistant with a needlestick injury. The rules are set by each state, so the answer to "do I need it" depends on where you practice.
California is on the strict end. The state's Division of Workers' Compensation says employers are required by law to have workers' compensation insurance even if they have only one employee (California DIR). Texas is the outlier on the other end, where the Labor Code makes coverage generally elective for most private employers (Texas Labor Code 406.002), though employers who opt out take on other obligations and lose some legal protections.
Most states fall in between, with thresholds based on employee count or business type. Set this up before your first hire, not after, and ask whether you as an owner should be covered or excluded under your state's rules.
Employment practices liability (EPLI)
Employment practices liability insurance covers claims from employees or applicants alleging discrimination, harassment, retaliation or wrongful termination. It is not about bad intent. Small practices hire quickly, often without an HR department, and a single disputed termination can turn into a costly defense.
Federal anti-discrimination laws enforced by the EEOC apply based on employee counts, with Title VII generally covering employers with 15 or more employees (EEOC coverage), but many state laws reach smaller employers. EPLI is usually optional at launch with one or two staff and becomes more valuable as the team grows. Some DPC malpractice programs bundle HR resources, which helps prevent claims in the first place.
Business interruption and umbrella coverage
Business interruption (also called business income) coverage replaces lost revenue and pays ongoing costs like rent and payroll when a covered event, such as a fire or a burst pipe, shuts you down. For a membership practice, revenue may keep arriving during a closure, but you still have to care for members somewhere, so ask about extra expense coverage that pays for a temporary location.
An umbrella policy adds liability limits above your general liability, auto and employer's liability policies. It generally does not sit above malpractice, which carries its own limits. Umbrella coverage makes sense once the practice has assets worth protecting or a vehicle used for home visits.
Pre-opening insurance checklist for a new DPC practice
Work through this list with your broker roughly 60 to 90 days before opening, alongside the rest of your DPC startup checklist.
- Check your state medical board for any required malpractice coverage or minimum limits.
- Read your current employment contract and confirm who pays for tail coverage when you leave.
- Get malpractice quotes from at least one DPC-specific program and one or two standard carriers, and decide between claims-made and occurrence.
- List every service you will offer (dispensing, in-house labs, compounded medications, home visits, telemedicine, procedures) and confirm each one is covered in writing.
- Read the insurance section of your lease and get the general liability limits and additional insured wording your landlord requires.
- Quote a business owner's policy that covers general liability, property and business interruption.
- Quote cyber liability, and compare any sublimit in your malpractice policy against a standalone policy.
- Confirm your state's workers' compensation rules and bind coverage before your first employee starts.
- Decide whether to add EPLI now or at your next hire, and whether an umbrella makes sense.
- Calendar every renewal date, since policies bought in the same month all renew together.
Keeping coverage in step with the practice
Insurance is easiest to get right at launch and easiest to let drift after, when new services, staff and locations get added faster than anyone updates the policy. A quick review with your broker each renewal, and any time you add a service or a hire, keeps the coverage list matching what the clinic actually does.
The same drift happens with day-to-day clinic work. Tabflows is a dedicated tech team that connects the tools a DPC clinic already uses, like the EHR, billing and messaging, so follow-ups, tasks and patient context stay in one place. That leaves fewer things to fall through the cracks between systems, which is its own kind of risk management.
When the insurance is in place, the next questions are usually pricing and panel size. Our guides to how much to charge for a DPC membership and DPC break-even panel size pick up from there.
FAQs
What insurance does a new direct primary care practice need?
Most new DPC practices start with professional liability (malpractice) for every clinician, general liability and property coverage (often bundled as a business owner's policy), cyber liability, and workers' compensation once they hire staff where their state requires it. Many also add employment practices liability, business interruption and an umbrella policy. This is about the practice's own business insurance, not the health insurance patients pair with their membership.
Is malpractice insurance cheaper for direct primary care doctors?
It can be, but it is not guaranteed. A DPC-focused program listed as a DPC Alliance sponsor says most practices see up to a 30% discount compared with traditional insurers, and the broker Cunningham Group says it has argued to carriers that DPC physicians are lower risk. Those are claims from companies selling coverage, not independent studies, so the honest answer is to get quotes from a DPC-specific program and from standard carriers and compare.
Should a DPC physician choose claims-made or occurrence malpractice coverage?
Claims-made policies usually cost less in the first years and cover claims made while the policy is active, so you need tail coverage (an extended reporting endorsement) or prior-acts coverage from a new carrier when you leave. Occurrence policies cover any incident that happened during the policy period, no matter when the claim is filed, so no tail is needed. The American College of Physicians notes a tail can cost 1.5 to 2 times a typical annual premium.
Do I need tail coverage when I leave my employed job to open a DPC?
If your employer's policy was claims-made, check who pays for the tail before you resign. You either need tail coverage from the old policy or prior-acts (nose) coverage from your new DPC carrier, or a gap opens for incidents from your employed years. Your employment contract usually says who is responsible.
Does a cash-only DPC practice need cyber insurance?
Most do. Whether a cash-only practice is a HIPAA covered entity depends on whether it conducts standard electronic transactions such as insurance claims, but state data breach laws apply either way, and a ransomware event or lost laptop costs real money in notification, forensics and downtime. Many DPC owners follow HIPAA as if covered and carry cyber coverage.
Is workers' compensation required for a small DPC clinic?
It depends on the state. California requires workers' compensation even for one employee, while Texas law makes coverage generally elective for most private employers. Check your state's workers' compensation agency before your first employee starts.