After you buy a non-clinical healthcare services company, first check that your professional liability policy names the services you sell, such as coding, billing and practice management. Next, confirm the cyber policy fits the patient data you hold for providers. Then check whether any policy pays to respond to a payer audit or a government investigation, and whether your limits meet what provider contracts demand. This checklist is for searchers, Small Business Administration (SBA) loan buyers and holding companies that just closed on a medical billing, revenue cycle, healthcare IT, practice management or non-clinical staffing business.
The short answer
- Billing and coding mistakes usually cause financial loss, not injury, so they belong to errors and omissions (E&O) coverage. Confirm the policy describes your real services.
- If you handle protected health information (PHI) for providers, you are likely a business associate under federal privacy rules. Size cyber coverage to your records, contracts and notice duties.
- Payer audits, repayment demands and government investigations are often excluded or carry a small sublimit (a smaller cap inside the main limit). Look for billing errors or regulatory coverage and read what it leaves out.
- Provider contracts and business associate agreements often set insurance minimums and indemnities. Check them against your policies before the first renewal.
- This guide does not cover clinical malpractice. If any part of the business touches patient care, bring in a medical professional liability specialist.
What kind of healthcare services company did you buy?
Healthcare services is a broad label, and the insurance questions change with what the business actually does for its provider clients. Start by naming it precisely.
| Business model | What usually goes wrong | Policies to check first |
|---|---|---|
| Medical billing, coding and revenue cycle management | Coding or claim errors, missed filing deadlines, denied claims, repayment demands | Errors and omissions, billing errors or regulatory coverage, cyber, crime |
| Practice management for physician groups | Management decisions, vendor failures, billing oversight, employee claims | Errors and omissions, cyber, employment practices, crime |
| Healthcare IT, software and support | System outages, data loss, a breach of patient records | Technology errors and omissions, cyber |
| Non-clinical staffing (front desk, billing, scheduling staff) | Placed worker errors, theft, discrimination or wage claims | Errors and omissions, crime, employment practices, workers' comp |
| Patient communications and call centers | Privacy complaints, misdirected messages, texting and calling rules | Cyber and privacy liability, errors and omissions; many policies exclude Telephone Consumer Protection Act (TCPA) and other unsolicited communication claims, so check for that exclusion |
If the business is mainly healthcare software or managed IT, the vertical software checklist and the managed IT services checklist go deeper on technology errors and omissions.
If any placed worker or service involves patient care, even part time, that is a clinical exposure. Medical professional liability is outside this checklist; get a specialist involved. For the general professional liability review, see the new owner review of professional liability.
Who pays when a billing or coding error costs a provider money?
Usually an errors and omissions policy, if it fits. General liability covers bodily injury and property damage, and a coding mistake causes neither. Errors and omissions policies are almost always claims-made, which means they cover claims first made while the policy is in force, for work done after the policy's retroactive date (the earliest date of work the policy covers). That makes three checks urgent after a deal:
- Services described. The policy should name billing, coding, credentialing, consulting or software services as the business really performs them.
- Retroactive date. In a stock purchase you can often ask the carrier to keep the existing retroactive date. In an asset purchase into a new company, a new policy may start its retroactive date at closing, leaving the seller's past work uncovered unless the carrier agrees to cover prior acts.
- Restitution and fee exclusions. Many policies exclude the return of your own fees (often a percentage of collections) and other amounts you were never entitled to keep. Whether a provider's repayment of an overpayment counts as covered damages depends on the policy's definition of damages, so read it before assuming either way.
A hypothetical example. A buyer acquires a billing company that serves 40 physician practices. Six months after closing, a client learns that a coding template the seller built two years earlier pushed a routine visit into a higher-paying code. The payer demands $250,000 back, and the practice sends the billing company a demand for that amount plus $60,000 in audit and legal costs. Whether insurance responds turns on the retroactive date, whether coding services are described in the policy and how the policy treats repaid overpayments. The lesson for a new owner: audit the coding templates and denial rates you inherited now, and check how long you have to bring an indemnity or escrow claim for errors made before closing under your purchase agreement (ask deal counsel).
For how retroactive dates and tails work at closing, see prior acts and tail coverage after an acquisition.
Does my cyber policy fit the patient data I hold?
Most of these companies handle patient records for doctors, hospitals or health plans. Under the Health Insurance Portability and Accountability Act (HIPAA), a company that creates, receives, keeps or sends protected health information for a covered entity (a health plan, a health care clearinghouse or a health care provider that HIPAA covers) is generally a business associate. The U.S. Department of Health and Human Services (HHS) treats business associates as directly responsible for parts of the privacy and security rules. Confirm your status with counsel; it shapes your contracts and your insurance.
The federal breach notification rule requires a business associate to notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery. State breach notification laws can add their own duties, including for employee and other personal data, so confirm with counsel which apply to you. Your business associate agreements may set shorter deadlines and may make you pay the provider's notification costs. That is where cyber coverage earns its keep. Check these points in the inherited policy:
- Breach response costs (forensics, legal advice, notification and credit monitoring) and whether they sit inside or outside the main limit.
- Regulatory defense and penalties coverage, which is often sublimited and pays penalties only where the law allows them to be insured.
- Liability to provider clients, including costs you agreed to pay in a business associate agreement. Some cyber policies exclude liability you took on by contract.
- Business interruption if your billing platform goes down, and coverage when the outage starts at a cloud or software vendor you depend on.
See the new owner review of cyber insurance and cyber risk during an IT migration if you plan to move systems after closing.
Will any policy pay for a payer audit or government investigation?
Maybe, but do not assume it. Billing companies can get pulled into payer audits, overpayment reviews and, in serious cases, government investigations under the federal False Claims Act, which can carry damages and penalties for false claims to government health programs. Many errors and omissions, cyber and directors and officers (D&O) policies exclude or limit claims about billing for government programs, fines and penalties, and money that has to be repaid.
Some carriers offer coverage built for this, sold under names like billing errors and omissions, regulatory proceedings or medical billing coverage. When you see it, read four things. Does a subpoena or civil investigative demand (a government request for documents and answers) count as a claim? How big is the sublimit? Does it pay only defense costs, or also some fines where insurable? And how does the fraud exclusion work? Many apply only after a final finding of fraud. The table shows how common situations tend to sort out. Your policy wording decides the real answer.
| Situation | Policy that usually responds | What to check |
|---|---|---|
| A practice sues over coding errors that cut its revenue | Errors and omissions | Services description, retroactive date, fee and restitution exclusions |
| A payer claws back money and the practice blames you | Errors and omissions, partly | Whether repaid amounts count as damages, contract indemnity |
| A government subpoena about your billing work | Billing errors or regulatory coverage, if purchased | Definition of claim, sublimit, fines and penalties wording |
| Ransomware locks the billing platform | Cyber | Business interruption, ransomware terms, vendor outage coverage |
| A stolen laptop holds unencrypted patient files | Cyber | Breach response limit, regulatory coverage |
| An employee diverts patient payments | Commercial crime | Employee theft and coverage for clients' money |
| A visitor slips in your office | General liability | Named insured and locations |
Provider contracts also often require you to screen staff against the federal list of excluded individuals kept by the HHS Office of Inspector General (OIG). If the seller screened staff, keep doing it after closing, and confirm the scope of your screening duties with healthcare counsel; a gap can create contract and payment problems that insurance does not fix.
What do provider contracts and business associate agreements require?
Hospitals, physician groups and health plans often write insurance terms into their service agreements and business associate agreements. Common terms include minimum errors and omissions and cyber limits, indemnity for breaches and billing errors, short incident notice deadlines, rules about subcontractors who touch patient data, and general liability with the client as an additional insured. Read your top contracts against the inherited policies; a certificate of insurance is a summary, not the policy.
Deal structure matters here too. In an asset purchase, many contracts with anti-assignment clauses need the client's consent to move to your company, and a new business associate agreement may be needed. That is a natural moment for the client to ask for higher limits. See how to check customer contracts against your policies and what to do when contracts require coverage you do not have.
What belongs on my first-month checklist?
| Check | Why it matters | Ask for |
|---|---|---|
| Errors and omissions | Billing, coding and management errors are the core exposure | Full policy, retroactive date, services description, change in control wording |
| Cyber and privacy | Patient data and business associate duties | Policy, application answers, record counts, breach history |
| Billing errors or regulatory coverage | Audits and investigations are often excluded elsewhere | Endorsement wording and sublimit |
| Commercial crime | Staff may handle patient payments or client bank access | Employee theft limit, coverage for clients' property, social engineering terms |
| Employment practices | Staffing models and headcount changes after closing | Policy, retroactive date, open charges |
| Workers' comp | Mostly office work, but class codes and audits still matter | Policy, payroll by class, experience rating worksheet |
| Top provider contracts | Limits, indemnity and consent to assignment | Top 20 contracts and business associate agreements |
Errors and omissions, cyber and employment practices policies are usually claims-made, and many have change in control wording. After a sale, that wording can limit coverage to acts before closing, and some versions end coverage altogether or require prompt notice to the carrier. If you have an investor board, also review directors and officers coverage; see D&O for a search fund board. For the documents to gather, see documents for an insurance review.
A single uncovered repayment demand can eat into the cash you planned for debt service, so it is worth testing the policies against your top provider contracts early. A Morrow review can do that side by side and request quotes where it makes sense.
Keep reading
- New Owner Review: Professional Liability (Errors and Omissions)
- New Owner Review: Cyber Insurance
- Prior Acts and Tail Coverage After an Acquisition: Who Pays?
- How to Check Your Customer Contracts Against Your Policies
- Just Bought a Managed IT Services Provider? Your Insurance Review Checklist
- All guides for new business owners
Frequently asked questions
Does general liability cover a medical billing mistake?
Usually not. General liability covers bodily injury and property damage. A coding or billing error causes financial loss, which is the job of errors and omissions coverage. Check that your errors and omissions policy describes billing and coding services and has the right retroactive date.
Is a medical billing company a HIPAA business associate?
Generally yes, if it creates, receives, keeps or sends protected health information on behalf of a provider or health plan. HHS guidance treats such companies as business associates with direct duties under parts of the rules. Confirm your status and contract terms with healthcare counsel.
Will insurance pay a False Claims Act settlement?
Often not in full. Many policies exclude fines, penalties and money that must be repaid, and some exclude government billing claims entirely. Specialized billing errors or regulatory coverage may pay defense costs and sometimes part of a settlement where the law allows. Ask counsel and read the wording.
Do I need medical malpractice insurance for a non-clinical healthcare company?
Usually not if the business never delivers or directs patient care. If any staff you place, services you run or software you provide could affect clinical decisions, talk to a medical professional liability specialist, because errors and omissions policies often exclude bodily injury from medical services.
Does the seller's cyber policy cover a breach found after closing?
It depends on the deal and the policy. The liability parts of a cyber policy are usually claims-made, and the breach response parts usually require the incident to be discovered during the policy period. Many also have change in control terms. In an asset purchase the seller's policy protects the seller's company, not yours. Make sure your own cyber policy is in force now, and ask the seller to report any incidents it knew about to its own carrier.
References
- U.S. Department of Health and Human Services: Business Associates (HIPAA guidance)
- 45 CFR 164.410: Notification by a business associate (via Cornell LII)
- U.S. Department of Health and Human Services: Breach Notification Rule
- U.S. Department of Justice, Civil Division: The False Claims Act
- HHS Office of Inspector General: Exclusions Program
- IRMI: Retroactive date (definition)
Just bought a business? Get your insurance reviewed.
Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.