HIPAA compliance consultants asked for $5M by a hospital system or health plan can meet it with one $5M primary policy or a primary plus excess layers that copy its terms.
The short answer
- $5M means a client wants up to $5M available for one claim from your advice. It can be met with one $5M primary policy or a primary plus follow-form excess layers, depending on carrier capacity and price.
- It is uncommon and usually comes from large hospital systems or health plans, often with a Cyber request.
- $5M is very rare online and almost always requires a broker. Morrow can help you find it.
What does a $5M requirement mean for HIPAA compliance consultants?
Professional Liability (E&O, short for Errors and Omissions) covers claims that your advice or services caused a client a financial loss. At $5M, a clause may read:
Illustrative contract wording
Contractor shall maintain Professional Liability (Errors and Omissions) insurance covering privacy, compliance and revenue cycle advisory services, with limits of not less than $5,000,000 per claim and $5,000,000 in the aggregate and Cyber liability insurance. Limits may be satisfied by a combination of primary and follow-form excess policies. Claims-made coverage shall be maintained for five (5) years after termination.
Illustrative example only. Your contract's wording controls.
- Per claim and aggregate: the most paid for one claim, and for all claims in a policy year.
- Stacking: this clause accepts primary plus excess. If yours is silent, confirm with the client that primary plus follow-form excess meets it.
- Five years after termination: Professional Liability is almost always claims-made, which means it covers claims first made while the policy is active. Every layer would usually renew, or add an extended reporting period (extra time to report claims after the policy ends), with the same retroactive date (the earliest work date the policy covers).
- Cyber is a separate policy: Cyber liability insurance covers data breaches and network failures. Professional Liability layers usually do not satisfy it, so quote Cyber separately. See Professional Liability vs Cyber.
Who asks HIPAA compliance consultants for $5M?
Many HIPAA compliance consultants carry lower limits such as $1M or $2M, and some reach $3M. Compared with $3M, $5M may add a second carrier and more underwriting time. It usually comes from:
- Multi-state hospital systems ordering a system-wide risk analysis.
- Large health plans whose vendor onboarding sets one high limit for every advisor.
- Large consulting, IT or revenue cycle firms passing their $5M requirement down to subcontractors.
- Government health programs may also write a high limit into their bid documents.
How is $5M built?
A primary policy pays first. An excess policy pays only after the layer below it is used up. "$3M xs $2M" means a $3M layer that sits above the first $2M. Stacked layers like these are often called a tower. A single $5M primary is one policy. A tower is several, each underwritten separately.
Example A: single policy
Example B: two layers
Example C: three layers
Each excess layer should follow form, meaning it adopts the primary policy's terms. Every layer should share the same retroactive date, policy period and named insured (the business the policy covers). Many policies pay defense costs inside the limit, so legal bills reduce what is left. Confirm each layer treats defense alike. A commercial umbrella almost never covers Professional Liability.
Good to know
Right form, right exclusions. HIPAA consultants are placed on either Miscellaneous Professional Liability (a general form for advice work) or Technology E&O, depending on the mix of work. Technology E&O is often the better fit for security risk analyses, assessments or breach response. General forms often exclude or restrict billing and coding advice, and may exclude privacy or regulatory claims, so confirm both with the carrier. Clinical care usually needs medical malpractice coverage instead.
What will underwriters ask for?
- Revenue by service: risk analyses, policies, training, audit prep, breach response and coding reviews (checking how medical services are coded for billing).
- Whether your coding or billing advice could lead to denied claims or payer recoupment (payers taking back paid money).
- Which client requires $5M, roughly how many patient records it holds, and the contract value.
- Whether you handle patient data, and the business associate agreements (contracts on protecting patient data) you sign.
- Three to five years of loss runs (a report of past claims) and your current policy, including its retroactive date.
- Any breach or regulator inquiry tied to your work.
What affects the cost?
- Type of work. Breach response, security testing and coding reviews usually cost more to insure than training or policy writing.
- Client size and records. System-wide projects carry bigger possible losses.
- Number of layers. Each layer is priced and underwritten on its own.
- Claims history. Past claims can reduce the limit offered.
- Retention and defense terms. A retention is like a deductible. A higher one usually lowers premium.
Frequently asked questions
What could a $5M claim look like for a HIPAA compliance consultant?
Hypothetical examples: your risk analysis misses an unsecured vendor connection, and a large breach leads to a lawsuit from the hospital. A multi-site coding review proves wrong, and payers recoup large sums. Whether a policy responds depends on its form and exclusions.
I carry $2M as a HIPAA compliance consultant. How do I get to $5M?
Request new quotes through Morrow, either for a new $5M primary or for excess layers above a primary. Morrow can ask carriers to keep your retroactive date and prior acts coverage (cover for work you did before the new policy began) where the market allows. Report anything that could become a claim to your current carrier before that policy ends.
How long does it take to get $5M Professional Liability as a HIPAA consultant?
It varies, and a multi-layer tower may take longer because each carrier underwrites its own layer. Send your contract requirement and current policy early so Morrow can start requesting quotes.
Looking for $5M in Professional Liability? Morrow can help.
Send us the insurance requirement from your contract and your current policy. Morrow can review both, including any Cyber request, and request quotes for a $5M primary or a primary with follow-form excess layers.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.