Who We Insure
Digital Therapeutics Insurance: When Prescription Software Is Regulated as a Medical Device
Digital therapeutics insurance has to treat software as a medical device, because the regulator does. A prescription digital therapeutic that delivers cognitive behavioral therapy, manages a chronic condition, or adjusts a treatment plan is cleared or authorized by the FDA on the strength of clinical evidence, and when it fails the claim is bodily injury, not a service-level credit. The main risks are a patient harmed by an algorithm or a missed escalation, a recall or enforcement action over a software change that was never submitted, and investor claims when reimbursement or a pivotal study disappoints.
Why digital therapeutics companies carry specialized insurance
Standard technology policies were not written for that. Tech E&O excludes bodily injury, general liability excludes professional and technology services, and products liability underwriters are used to physical devices with a bill of materials. A digital therapeutics company needs a program assembled from those pieces with the exclusions reconciled, plus clinical trial coverage for the studies that get the product cleared and keep it reimbursed. This guide covers Tech E&O and products liability for software as a medical device, cyber, clinical trial liability, D&O, and professional liability where clinicians are part of the product, along with what partners require and what underwriters ask about the regulatory file.
Who this guide is for
Written for founders, chief medical officers, regulatory affairs leads, and general counsel at prescription and non-prescription digital therapeutics companies, software-as-a-medical-device developers, and digital health companies pursuing FDA clearance. Prescription digital therapeutics cleared through 510(k) or De Novo pathways for behavioral, neurological, metabolic, or pain conditions; Software-as-a-medical-device companies providing clinical decision support that falls inside device regulation; Wellness and behavioral apps planning the move from general wellness to regulated claims; Not for conventional connected hardware — the medical device guide covers devices with a physical product.
The risk profile of a digital therapeutics company
A digital therapeutic combines the liability of a drug-like intervention, a regulated device, and a consumer app, and the claims come from patients, regulators, partners, and investors in roughly that order of frequency. Key exposures: Patient injury from a therapeutic algorithm that recommended the wrong intervention, failed to escalate a crisis response, or interacted badly with a concurrent treatment; FDA enforcement, recall, or correction after a software update changed the device's function without a new submission or adequate validation; Clinical trial injuries and consent claims in pivotal and post-market studies, including decentralized trials run through the app itself; Breaches of treatment records and behavioral data, and premarket cybersecurity findings under the FDA's requirements for cyber devices; Efficacy and marketing claims challenged by the FTC, competitors, or payers when real-world outcomes lag the trial data; Investor claims when reimbursement codes, payer coverage, or a partnership with a pharmaceutical company fail to materialize.
Technology E&O With Bodily-Injury Carve-Back for digital therapeutics companies
The software can fail as software — an outage, a data error, a failed integration with an electronic health record — and the customer claim for that is a classic Tech E&O loss. For a digital therapeutic the same failure can injure a patient, and most Tech E&O forms exclude bodily injury. The program needs a Tech E&O form with an affirmative bodily-injury carve-back for the technology product or a combined medical technology form, and the two policies must not each exclude the claim.
Products Liability for Software as a Medical Device for digital therapeutics companies
A cleared digital therapeutic is a product, and patient injury claims will be pleaded as design defect, manufacturing defect, and failure to warn. Products liability written for medical devices, with software expressly included in the product definition, responds to those claims. Underwriters will ask for the design controls, the risk-management file, the complaint-handling process, and the labeling, exactly as they would for hardware.
Cyber Liability for digital therapeutics companies
Treatment data for behavioral, addiction, and neurological conditions is among the most sensitive health information there is, and the FDA now expects cyber devices to ship with a software bill of materials, vulnerability management, and a plan for post-market patches. Cyber covers breach response, regulatory defense, and liability, and the strength of the premarket cybersecurity file is now part of the underwriting conversation.
Clinical Trial Liability for digital therapeutics companies
Pivotal studies, post-market commitments, and payer-required real-world evidence studies all enroll human subjects. Clinical trial liability responds to subject injury and consent claims, satisfies institutional review board and site requirements, and must be placed country by country where studies run abroad. Decentralized trials conducted inside the app change the site picture but not the obligation.
Directors & Officers Liability for digital therapeutics companies
Digital therapeutics is a sector where well-funded companies have failed on reimbursement rather than on science, and investors have sued. D&O responds to shareholder and investor claims over disclosure and strategy, covers regulatory investigations of the company and its officers, and is required by most institutional investors and pharmaceutical partners before they commit.
Medical Professional Liability for Embedded Clinicians for digital therapeutics companies
Where coaches, therapists, or prescribers deliver care through the product, their judgment is a separate exposure. Medical professional liability for the clinical entity keeps a claim that mixes algorithm and clinician from falling between carriers.
Contract and certificate requirements
Health system and payer customers require Tech E&O and cyber at stated limits with business associate agreements behind them, and increasingly ask for products liability once the product is a cleared device. Pharmaceutical co-development and co-promotion partners add their own insurance exhibits, often with product liability limits modeled on drug programs, and they expect clinical trial coverage for every study the partnership funds. Research sites and institutional review boards require clinical trial liability certificates before enrollment. Distribution agreements with pharmacies and specialty hubs allocate recall costs and product claims, and the program should match whatever those agreements make the company responsible for.
What coverage costs
Pricing reflects the regulatory status and indication of the product, the severity of the condition treated, patient volume, the clinical evidence behind the claims, software-change controls, and the history of complaints, recalls, and adverse-event reports. Behavioral and crisis-adjacent indications price differently from metabolic ones because the injury scenarios differ. Clinical trial pricing depends on the number of subjects, the study design, the countries involved, and the indication. D&O pricing follows capital raised, reimbursement status, and partnership structure. Cyber pricing turns on the premarket cybersecurity file, data volume, and controls.
What underwriters will ask for
The regulatory file is the underwriting file. Companies that can produce it quickly get better terms and fewer subjectivities. Have ready: Regulatory status for each product — clearance or authorization type, indication, labeling, and any enforcement discretion relied on; Quality management system summary, design controls, software-change and validation procedures, and complaint and adverse-event handling; Clinical evidence summary, active and planned studies, sites, countries, and institutional review board approvals; Premarket and post-market cybersecurity documentation, software bill of materials, and vulnerability-response process; Commercial model: prescription or over-the-counter, reimbursement pathway, pharmaceutical or health system partnerships, and patient volume; Clinician involvement in the product, the employing entity, and the professional liability in place.
Illustrative example: The escalation that never happened
A prescription digital therapeutic for a behavioral condition routes patients expressing crisis indicators to a live response. A logic change in a routine update narrows the triggering phrases, a patient's statements are not escalated, and the patient is seriously harmed. The family sues the company and the prescribing clinic. Products liability responds to the design-defect and failure-to-warn allegations, Tech E&O with a bodily-injury carve-back responds to the software-failure framing, and the clinic's malpractice policy responds for the prescriber. The software-change record is the central evidence.
Illustrative example: The update that needed a submission
An engineering team ships an improvement to the therapeutic algorithm that changes dosing recommendations. The FDA later concludes the change altered the device's intended use, issues a warning letter, and requires a correction across the installed base. Products liability and recall coverage, where purchased, respond to correction and notification costs within their terms, and D&O's regulatory coverage funds counsel for the company and its officers through the enforcement process. Fines and the cost of the new submission are not insured.
Illustrative example: The partnership that collapsed
A pharmaceutical partner terminates a co-promotion agreement after a payer coverage decision goes against the product. The company's valuation falls, a financing is done at a lower price, and earlier investors allege the company overstated the likelihood of coverage. D&O defends the company and its directors and officers against the investor claims. The record of what was disclosed about reimbursement risk in board materials and financing documents is the evidence that decides it.
What does digital therapeutics insurance cost?
It depends on the product's regulatory status and indication, the condition's severity, patient volume, clinical evidence, quality system maturity, complaint and recall history, and the number of studies and partnerships. As of 2026, the products liability and clinical trial components move the total most for companies with cleared prescription products.
Does Tech E&O cover a patient injured by our software?
Usually not without negotiation. Most Tech E&O forms exclude bodily injury. A digital therapeutics program needs an affirmative carve-back for bodily injury arising from the technology product, or a medical technology form that combines E&O and products liability, so that an injury claim is not excluded by both policies.
Do we need products liability if the product is only software?
Yes, once it is a regulated device. Courts and claimants treat cleared software as a product, and injury claims are pleaded as design defect and failure to warn. Products liability written for medical devices with software included in the product definition is the standard response.
Is clinical trial insurance required for a decentralized trial run inside the app?
Yes. The absence of a physical site does not remove subject-injury liability or the institutional review board's requirement for coverage, and studies that enroll subjects in other countries need local policies where regulations require them. Sponsor-level clinical trial liability should list every active protocol.
How does the FDA's cybersecurity requirement for devices affect coverage?
Cyber underwriters now ask for the premarket cybersecurity documentation — software bill of materials, threat model, vulnerability management, and patch plan — because a device that cannot be patched is a device that cannot be defended. A strong file improves terms and reduces subjectivities.
Caveats and common gaps
Bodily-injury carve-backs under Tech E&O vary in scope and may be limited to the technology product as cleared. Products liability forms may exclude software unless the product definition is amended. Recall coverage is a separate purchase. Clinical trial coverage is protocol- and country-specific. Regulatory coverage under D&O does not pay fines, penalties, or the cost of new submissions.
Related guides
Insurance for Medical Device Companies — the hardware device program this page adapts to software · Insurance for Mental Health Apps — behavioral products below the device line · Insurance for Clinical Trial Sponsors & CROs — the study coverage pivotal and post-market trials require · Insurance for Healthtech Companies · Insurance for GLP-1 & Weight-Loss Telehealth Companies · Tech E&O insurance · D&O insurance for startups
Frequently asked questions
What does digital therapeutics insurance cost?
It depends on the product's regulatory status and indication, the condition's severity, patient volume, clinical evidence, quality system maturity, complaint and recall history, and the number of studies and partnerships. As of 2026, the products liability and clinical trial components move the total most for companies with cleared prescription products.
Does Tech E&O cover a patient injured by our software?
Usually not without negotiation. Most Tech E&O forms exclude bodily injury. A digital therapeutics program needs an affirmative carve-back for bodily injury arising from the technology product, or a medical technology form that combines E&O and products liability, so that an injury claim is not excluded by both policies.
Do we need products liability if the product is only software?
Yes, once it is a regulated device. Courts and claimants treat cleared software as a product, and injury claims are pleaded as design defect and failure to warn. Products liability written for medical devices with software included in the product definition is the standard response.
Is clinical trial insurance required for a decentralized trial run inside the app?
Yes. The absence of a physical site does not remove subject-injury liability or the institutional review board's requirement for coverage, and studies that enroll subjects in other countries need local policies where regulations require them. Sponsor-level clinical trial liability should list every active protocol.
How does the FDA's cybersecurity requirement for devices affect coverage?
Cyber underwriters now ask for the premarket cybersecurity documentation — software bill of materials, threat model, vulnerability management, and patch plan — because a device that cannot be patched is a device that cannot be defended. A strong file improves terms and reduces subjectivities.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.