Is a business owners policy (BOP) enough for a clinical-trials company or CRO?

A BOP gives a CRO general liability and property coverage in one package - genuinely useful, and enough to satisfy an office lease and ordinary third-party claims. But a CRO sells a service and runs on data, and the claims most likely to threaten it come from the service failing, a trial subject being injured, or a data breach. None of those are covered by a BOP.

The practical test is what a sponsor requires. Sponsor CTAs and MSAs specify professional liability, often clinical trial liability, and increasingly cyber - by line and by limit. A CRO presenting only a BOP certificate is non-compliant on the coverages that matter and will be caught at contract review.

General liability at $1M/$2M for third-party bodily injury and property damage - a visitor hurt at the office, damage to a landlord's premises. Commercial property for the CRO's equipment, tenant improvements, and contents. Often business interruption for lost income after a covered physical-damage event.

This is the operating floor. Most leases and many vendor contracts require exactly this, which is why a BOP is usually the first policy a small CRO buys. The error is stopping there.

Professional liability (E&O): for a CRO, the service is the exposure. A protocol-execution error, a monitoring failure, a data-management or pharmacovigilance lapse, a regulatory-submission mistake - these produce claims that general liability does not touch. E&O is the load-bearing line for a research organization and is not in a BOP.

Clinical trial liability: bodily injury to trial subjects, required by protocols, IRBs/ethics committees, and sponsor CTAs before enrollment. A CGL/BOP policy generally will not respond to trial-subject injury; clinical trial liability is a distinct tower.

Cyber liability: a CRO holds trial datasets, subject PHI, and sponsor proprietary information. Cyber covers breach response, notification, and liability - a core line for a data-driven business, and one sponsor CTAs increasingly specify with a limit and data-handling terms. Not in a BOP.

Sponsor contracts contain an insurance schedule itemizing required coverages, limits, and endorsements - typically professional liability at a specified limit with the sponsor as additional insured and primary/non-contributory wording, clinical trial liability where human subjects are involved, and often cyber and umbrella. The certificate of insurance is checked against that schedule before the contract is signed.

A CRO whose only policy is a BOP will show general liability and property on its certificate and nothing else. That fails the schedule on E&O, on clinical trial liability, and frequently on cyber and umbrella - the exact lines the sponsor cares most about. Discovering this at signing delays the contract; discovering it after a claim leaves the CRO exposed for the uncovered lines.

The BOP is not wasted - it stays as the general-liability and property layer. On top of it, a small CRO adds professional liability (E&O) and clinical trial liability as the exposure-defining coverages, cyber for trial data and PHI, workers compensation for staff, D&O once outside capital arrives, EPLI alongside the D&O program, and an umbrella when a sponsor contract specifies a combined limit the primary lines can't reach.

Running each sponsor CTA and MSA against the current program before signing is what turns this from a reactive scramble into a clean certificate. The BOP answers the lease; the specialty tower answers the sponsor.