Medical Offices · California

Protect the practice, not just the practice.

The business side of a medical, dental, chiropractic or therapy practice: the office, the equipment, the income and the people who work there.

By Sam Alishahi · CA Insurance License #4348151 · Reviewed November 2026 · How this page is researched

Get a Quote Call (877) 711-4545

How it works

Malpractice covers the care. This covers the office.

Medical malpractice covers claims about patient care, and it's written by specialty malpractice carriers. Everything else about running a practice is a business policy: the equipment and build-out, a slip in the waiting room, the income you lose when the office floods, and patient records if they're breached.

I package office coverage for outpatient practices, including property, general liability, business income, cyber and workers' comp, so it fits alongside the malpractice policy you already carry.

Equipment and build-outImaging, dental chairs, computers and tenant improvements.
General liabilityInjuries in the office that aren't about treatment.
Business incomeLost income and extra expense after a covered loss.
CyberPatient-data breaches and ransomware.

Who I help

Practices that call me

Physician and specialist offices

Outpatient practices.

Dental offices

Equipment-heavy practices.

Chiropractic and physical therapy

Treatment-room exposures.

Therapists and counselors

Small offices and group practices.

Patient data

Breach and ransomware coverage. See details

Staff

Workers' comp and employment practices. See details

Before you call

What underwriters will ask

Having these ready means I can go to market on the first call. The quote form asks for the same things, and anything you don’t know yet can wait.

Start the Quote Form

Practice: specialty, number of providers and locations.
Office: square footage, lease and improvements.
Equipment: value of major equipment.
Revenue and staff: annual revenue, payroll and employees.
Records: electronic health records and data controls.
History: current policies and claims.

A patient-data breach starts a 60-day clock

Under HIPAA's Breach Notification Rule (45 CFR 164.402), an acquisition, access, use or disclosure of protected health information that the Privacy Rule doesn't permit is presumed to be a breach unless you can show a low probability that it was compromised. You show that with a four-factor risk assessment: what information and identifiers were involved and how likely re-identification is, who used or received it, whether it was actually acquired or viewed, and how far the risk has been reduced. After discovery, the deadlines are:

Patients, within 60 days. Notice must go out without unreasonable delay and no later than 60 calendar days after discovery (164.404). It goes by first-class mail, or by email if the patient agreed to electronic notice. In plain language, it says what happened, what information was involved, what patients should do, what you're doing, and how to reach you.
Bad addresses. If contact information is out of date for 10 or more people, substitute notice means a conspicuous posting on your website's home page for 90 days or a conspicuous media notice, plus a toll-free number that stays active for at least 90 days.
The media. A breach involving more than 500 residents of a state or jurisdiction also requires notice to the media, on the same 60-day limit (164.406).
HHS. At 500 or more people, you notify the Secretary at the same time as the patients. Under 500, you keep a log and report within 60 days after the end of the calendar year (164.408).
Your vendors. A business associate that discovers a breach must notify you without unreasonable delay and no later than 60 calendar days after it discovers it (164.410), so I'd ask each vendor how fast it will tell you.

The rule applies to "unsecured" information, meaning information that hasn't been made unusable, unreadable or indecipherable under HHS guidance. That's why I ask how your laptops, backups and email are protected before I take a practice to market.

California adds its own deadlines

California layers its own rules on top of HIPAA.

Licensed clinics and facilities: 15 business days. Health and Safety Code 1280.15 applies to a clinic, health facility, home health agency or hospice licensed under section 1204, 1250, 1725 or 1745. Unlawful or unauthorized access to patient information must be reported to the state department and to the patient no later than 15 business days after it's detected. Administrative penalties run up to $25,000 per patient and up to $17,500 per subsequent occurrence, plus $100 for each day a report is late. The combined total is capped at $250,000 per reported event. Under section 1206(a), an office owned or leased and operated by licensed practitioners for practice within the scope of their license is generally exempt from clinic licensing, apart from the surgical-clinic option, so 1280.15 often won't reach a private physician office. I'll ask which kind of location you run.
Patients can sue without proving a loss. Under Civil Code 56.36(b), a patient whose information was negligently released can sue for nominal damages of $1,000 without showing actual damages, and can also recover actual damages. Subdivision (e) gives some covered entities a defense to the nominal damages. Under 56.36(c), negligent disclosure can bring an administrative fine or civil penalty of up to $2,500 per violation.

Outside California, state breach and medical-privacy laws vary by state. When you have offices in more than one state, I build the cyber submission around each state where your patients live. There's more on the California side in my California small business cyber guide.

Matching a cyber policy to those duties

NAIC notes that most commercial property and general liability policies don't cover cyber risks, and that cyber policies are highly customized. The FTC's small-business guidance lists what cyber coverage typically includes. Here's how I check that against a medical office's duties:

The risk assessment. Look for legal counsel to determine your notification and regulatory obligations, and forensic services to investigate the breach. Those two answer the 164.402 questions: what was taken, and whether it was actually viewed.
The mailing and the phone line. Look for customer notification and call center services. That's the first-class mail and, in a bad case, the 90-day toll-free number.
Ransomware downtime. Look for lost income due to business interruption, cyber extortion, and recovery and replacement of lost or stolen data.
Regulators and patients. The FTC lists fees, fines and penalties related to the incident on the first-party side. On the third-party side it lists costs for responding to regulatory inquiries, payments to affected consumers, and claims and settlement expenses. Each policy words these differently, so I read the definitions, not the summary page.
Your vendors' breaches. The FTC says a policy should cover attacks on your data held by vendors and other third parties. For a practice, that means your EHR, billing and IT vendors.

I also check whether the carrier has a duty to defend you in a lawsuit or regulatory investigation, and whether there's a breach hotline that answers around the clock. More detail is on my cyber liability page.

When the vaccine refrigerator fails

If you stock vaccines or refrigerated medications, a failed unit or a long outage can mean throwing out inventory and calling patients back. CDC's storage guidance names the costs of revaccinating patients and replacing expensive vaccines as reasons to use proper equipment. These are the CDC practices I'd want documented before anything goes wrong:

The right unit. CDC prefers purpose-built or pharmaceutical-grade units. A stand-alone household-grade unit may be acceptable in some settings. Vaccine should never be stored in a dormitory-style or bar-style combined unit.
A digital data logger. CDC recommends, and the Vaccines for Children program requires, a digital data logger that records at least every 30 minutes. CDC says it shows how long a unit has been operating outside the recommended range, the record you'd want if you file a claim.
An excursion routine. Label affected doses "DO NOT USE," keep them separate, don't throw them out, call your immunization program or the manufacturer, and document everything you did.
A power plan. Written procedures for equipment failure and power outages, a plan to contact an alternative storage facility before packing any vaccine to move it, and, if you have a backup generator, quarterly testing and annual service.

On the insurance side, I check three things in your property or business owner's policy. First, whether spoilage is included and whether it applies to medications and vaccines. Second, whether it responds to a utility outage that starts off your premises or only to a breakdown of your own unit. Third, what the equipment breakdown part says about the compressor and controls. CDC says not to discard exposed doses before you get guidance, so keep them until you hear back.

Questions

Medical office insurance, answered

Doesn't my malpractice policy cover the office?

No. Malpractice covers claims about patient care. Property, general liability and business income are separate business coverages.

Is expensive equipment covered?

Equipment can be covered for fire, theft and other causes, and equipment breakdown can be added for electrical or mechanical failure.

Do we need cyber insurance?

Practices that hold patient records often do. A breach can bring notification costs, regulatory issues and downtime.

What do underwriters rate on?

Specialty, location, equipment values, revenue and claims history.

Do we have to report a HIPAA breach that affected fewer than 500 patients?

Yes. Each affected patient still gets notice within 60 calendar days of discovery, and you keep a log and report those breaches to HHS within 60 days after the end of the calendar year (45 CFR 164.404 and 164.408).

Do you offer medical office insurance outside California?

Yes. Clients across the country send the same quote form. Sam Alishahi is licensed in all 50 states and Washington, DC and places policies there directly. The shopping across carriers works the same way. Rules, minimums and markets differ by state — see insurance requirements by state.

Official sources

Often placed alongside this

Coverage

Business owner’s policy

Property, liability and business income bundled for small businesses.

See coverage Coverage

Physical therapy clinic insurance

Professional liability and business coverage for PT and rehab clinics.

See coverage Coverage

Medical malpractice insurance

Professional liability for physicians, dentists, nurses and allied health.

See coverage

Also covered with this: Acupuncturist insurance Medical supply store insurance Optometrist insurance Podiatrist insurance Medical billing insurance Medical lab insurance Office building insurance Pharmacy insurance Surgery center insurance Chiropractor insurance

By state: Insurance requirements by state

Medical office insurance

Tell me about your practice. I'll shop it.

Your specialty, location and equipment values are enough to start.

Get a Quote Call (877) 711-4545

Alishahi Insurance · Saman Alishahi, independent insurance broker, California License #4348151. General information, not a quote or a promise of coverage; coverage depends on underwriting and the terms, conditions and exclusions of the policy actually issued.

Get a quote

Tell me how to reach you. I’ll take it from there.

Takes about 30 seconds. Your next step comes by email, and you get an update at every step until your quotes are ready.

(877) 711-4545

Answered 24/7 · CA License #4348151

Full name

Mobile phone

ZIP (optional)

Anything I should know? (optional)

Only your name, phone and email are required; every question here is optional. This is a request for insurance: Alishahi Insurance (Saman Alishahi, licensed insurance agent) will contact you about it by email, and by text if you check the box. Sending this form doesn’t bind coverage; coverage starts only when it’s confirmed in writing.

Not shopping yet?

Get a reminder before your renewal.

Tell me when your policy renews and I’ll email you about six weeks before, when it’s worth comparing. One email, no calls.