What insurance does a telehealth or virtual-care company need?

Telehealth sits at the intersection of a medical practice and a technology company, so the program has two centers of gravity: the clinical care (which creates medical-malpractice exposure) and the platform and data (which create cyber and technology exposure). Around those two lines sits the ordinary business stack - general liability and property, workers compensation once there are employees, and directors-and-officers once investors are involved.

The structure determines who holds what. Most telehealth companies are organized as a PC-MSO, and you insure the professional corporation for the clinical exposure and the management-services organization for the platform and data exposure. Getting that split right is the difference between a program that responds and one that leaves a gap between two policies.

The clinical entity needs professional liability (medical malpractice) covering patient injury arising from the telemedicine care its clinicians provide. For a network of prescribing clinicians this is usually written at the entity level to cover the practice's vicarious liability, rather than as individual policies for each physician, and for a fluid network it is rated on projected patient volume or revenue rather than a fixed physician headcount.

The exposure is amplified by multistate operation (clinicians licensed and seeing patients across many states) and by the clinical scope, especially prescribing. Companies prescribing controlled substances or high-scrutiny medications such as GLP-1 weight-management drugs face closer underwriting.

A telehealth platform runs on software and holds sensitive patient data - protected health information subject to HIPAA, plus payment and account data. Cyber liability covers breach response, notification, regulatory exposure, and ransomware, while technology errors and omissions covers claims that the platform software or connectivity failed. For a company whose product is the platform, both are core lines, not add-ons.

The two can be written together or separately. Payor contracts, partner agreements, and pharmacy relationships increasingly specify a required cyber limit and data-handling terms, so the number is often set by the largest contract.

General liability and property: the operating floor for ordinary third-party claims and office or equipment, usually at $1M/$2M as leases and vendor contracts require.

Directors and officers (D&O): triggered by outside capital; investors typically require it at the first institutional round.

Workers compensation: required by statute once there are employees.

Employment practices liability (EPLI) and management liability round out the picture as headcount grows.

Telehealth companies rarely set their own limits in a vacuum. Payors, retail and employer partners, and fulfillment pharmacies impose insurance requirements through their contracts, and those requirements usually dictate the professional liability, cyber, and umbrella limits the company must carry. Running each partner or payor agreement against the current program before signing is what keeps a telehealth company compliant as it scales.