$1M Professional Liability (E&O) Insurance for HIPAA Compliance Consultants

For HIPAA compliance consultants: a $1M Professional Liability (E&O) requirement usually means a policy that pays up to $1M per claim when a client says your work caused a financial loss.

What does a $1M requirement mean for HIPAA compliance consultants?

Professional Liability (E&O, short for Errors and Omissions) covers claims that your advice or services caused a client a financial loss. For a HIPAA compliance consultant, the claim usually says your risk analysis, policies, training or breach advice fell short. A typical clause looks like this:

• Per claim: the most the policy pays for one claim. Here, $1M.
• Aggregate: the most the policy pays for all claims in one policy year. Here, $2M. A $1M/$1M policy falls short. A $1M/$2M policy usually meets either wording.
• Claims-made: the policy covers claims made and reported while it is active, for work on or after the retroactive date (the earliest work date the policy covers).
• Cyber: this clause also asks for Cyber, which is a separate policy.

Who asks HIPAA compliance consultants for $1M?

HIPAA compliance consultants often see a $1M request from:

• Physician, dental and behavioral health practices needing a risk analysis or policy update.
• Billing companies, software vendors and other business associates (outside firms that handle patient data for a provider) preparing for a client audit.
• Clinics, home health agencies and small hospitals that need privacy officer support or staff training.
• IT firms and larger consultancies that subcontract the HIPAA part of a project to you.
• Hospital systems and health plans on small projects. Larger work may bring a $2M limit, which gives more room if one claim is large. See $2M for HIPAA compliance consultants.

How is $1M built?

At $1M, the limit is usually one primary policy (the policy that pays first). HIPAA consultants often buy Miscellaneous Professional Liability, a general form for service businesses whose work is advice rather than a product. If your work is mostly technical, such as security testing or network setup, Technology E&O is often the form used, commonly paired with Cyber. Licensed clinicians who treat patients usually look to medical malpractice coverage instead.

Cyber policies often cover data breach costs and privacy claims, even for data you hold yourself. It depends on the wording. Professional Liability alone usually does not. See Professional Liability vs Cyber. Morrow can check your contract against your policy. Common trouble spots are the aggregate, the retroactive date and any privacy exclusions.

What will underwriters ask for?

An underwriter is the person at the insurer who decides whether to offer coverage and on what terms. For HIPAA compliance consultants, they often ask:

• Your services and the share of revenue from each: risk analyses, policy writing, staff training, privacy officer support, audit preparation or breach response advice.
• Whether you only advise, or also do hands-on technical work like security testing or system setup.
• Who your clients are: small practices, business associates, hospitals or health plans.
• Whether you access, store or move patient data, and whether you sign business associate agreements (contracts that set how you protect patient information).
• How you document findings, and whether every job has a written contract and scope.
• Prior claims, any client breach or government inquiry that involved your work, and your current policy and retroactive date.

What affects the cost?

• Type of work. Hands-on security work and breach response usually cost more than training or policy writing.
• Revenue and client size. Larger clients hold more records, which can mean a bigger possible loss.
• Data access. Direct access to patient data can raise the price, and often brings Cyber into the picture.
• Claims history. Prior claims can raise the price or narrow options.
• Policy terms. $1M/$2M usually costs more than $1M/$1M. A higher aggregate or a lower retention (what you pay on each claim before the policy pays) usually raises the premium.

Frequently asked questions

Do I need $1M Professional Liability as a HIPAA compliance consultant?

Often yes if a client contract asks for it, and health care clients often do. Check whether the clause says $1M/$1M or $1M/$2M, and whether it also asks for Cyber.

What kinds of claims do HIPAA compliance consultants face?

Claims usually say your risk analysis, policies or breach advice fell short. Hypothetical examples: your risk analysis leaves out a cloud system, and a breach there leads to a government investigation. Or breach advice misses a notice deadline, and the client blames you. Many policies exclude fines and penalties, but they may pay to defend the claim.

Is $1M enough if a hospital or health plan is the client?

Not always. These clients may ask for higher limits and Cyber, so check the clause before you assume $1M is enough. If the clause asks for more, see $3M for HIPAA compliance consultants or $5M. The $3M limit is rarely found online, and $5M is very rare online. Morrow can help you find them.

I have $1M/$1M and the contract asks for $1M/$2M. What now?

Request new quotes for a $1M/$2M policy. Morrow can request quotes and ask for your retroactive date to be kept, along with prior acts coverage (cover for work done before the new policy starts), where the market allows. Report anything that could become a claim to your current carrier before that policy ends.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.