Professional Liability (E&O) Requirements for Healthcare Vendors to Hospitals and Health Systems

Hospitals and health plans often ask billing, credentialing, consulting and IT vendors for higher Professional Liability (E&O) limits. Many also want Cyber (data breach coverage) in the same clause.

What does a hospital Professional Liability requirement mean for healthcare vendors?

Professional Liability (E&O, for Errors and Omissions) covers claims that your work or advice caused a client a financial loss. Health systems often list it with Cyber and General Liability (coverage for injury and property damage claims) in one clause, and ask for a certificate of insurance (a document that shows your coverage) before you start:

• Per claim and aggregate: per claim is the most paid for one claim. Aggregate is the most paid for all claims in a policy year.
• Two coverages, two jobs: Professional Liability covers mistakes in your services. Cyber covers data breaches and privacy claims.
• Claims-made: Professional Liability is almost always claims-made. It pays only for claims first made against you and reported while the policy is active, for work after the retroactive date (the earliest work date the policy covers). That is why clauses ask you to keep coverage after the contract ends. A tail (extra time to report claims) can often meet this, but it usually must be bought soon after the policy ends.

Who asks healthcare vendors for higher Professional Liability limits?

These clauses often go to:

• Medical billing and coding companies
• Credentialing and provider enrollment services
• Revenue cycle and compliance consultants
• IT, software and data analytics vendors
• Staffing firms placing non-clinical workers

See $3M Professional Liability for medical billing companies and $3M for credentialing services. Hypothetically, if a billing firm's coding error made a hospital repay payers, the hospital might seek that loss from the vendor.

Licensed clinicians who treat patients usually need medical malpractice coverage instead.

How is Professional Liability built for hospital vendors?

Many non-medical vendors buy Miscellaneous Professional Liability, a form for service businesses. IT and software vendors usually need Technology E&O (a form built for tech services and software), which is often sold together with Cyber.

For higher limits, you can buy one primary policy (the policy that pays first) at the full limit, or a smaller primary plus excess layers above it. Excess layers should follow form (use the same terms as the policy below). A commercial umbrella almost never covers Professional Liability, so it usually cannot fill the gap.

At $3M the search usually moves to a broker, and $5M and above almost always needs one. Morrow can help you find it. For how the two coverages differ, see Professional Liability vs Cyber.

Already have a policy? Ask Morrow to request new quotes at the limit the contract needs, as a new primary or as excess layers. Ask to keep your retroactive date and prior acts coverage (cover for past work) where the market allows, and report known incidents to your current carrier before switching. Confirm with the client that primary plus follow-form excess meets the clause.

What will underwriters ask for?

An underwriter is the insurer's reviewer who decides whether to offer coverage. They often ask about:

• Your services, healthcare revenue share and largest contracts
• For billing and coding, how you check claims before sending them
• How you store and protect patient data
• Whether you sign business associate agreements (contracts on handling patient data)
• Past claims, possible claims, and your current policy and retroactive date

What affects the cost?

• Type of work. Billing and coding can lead to payment error claims, so it may price differently than consulting.
• Patient data. More patient records mean more Cyber exposure.
• Limit and structure. A higher limit, or primary plus excess layers, changes what carriers offer and charge.
• Claims history and controls. Prior claims often raise cost.
• Retention and defense terms. The retention is what you pay on a claim before the policy pays, like a deductible. Many policies pay defense costs (legal fees) inside the limit, which can use up money meant for a claim.

Frequently asked questions

Does Professional Liability cover fines, or a hospital's repayment losses from my billing errors?

It depends on the wording. Fines and penalties imposed on you, and the return of your own fees, are commonly excluded. A client's repayment losses caused by your error may be covered as damages, subject to any billing or regulatory exclusions.

Do I need Cyber if the contract only asks for Professional Liability?

It depends on the contract. The clause alone may not require Cyber, but check the rest of the agreement, such as a data security section. Breach notification and recovery costs are usually not covered by Professional Liability.

What should I do if a hospital vendor portal rejects my certificate of insurance?

Portals often flag a low limit, a missing coverage or an expired date. Match the flagged gap to the contract wording first, then send Morrow the requirement so we can request quotes.

I place nurses and IT staff. Which policy do I need?

Often both. Clinical placements typically call for medical malpractice, and non-clinical work usually calls for Professional Liability.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.