Who We Insure
Medical Billing Errors and Omissions Insurance: Coding Clawbacks, False Claims Act Exposure and PHI Breaches
Medical billing errors and omissions insurance covers a company whose product is other people's revenue. When a billing or revenue cycle management company codes a claim wrong, misses a filing deadline, or lets a payer's recoupment go unanswered, the provider loses money it would otherwise have collected and looks to the vendor to make it whole. When the coding pattern looks like upcoding or unbundling, the exposure stops being a contract dispute and becomes a False Claims Act matter in which the billing company can be named with the practice.
Why medical billing & RCM companies carry specialized insurance
The data makes the second half of the risk. A billing company holds protected health information for every patient of every client, usually with direct connections into practice management systems, clearinghouses, and payer portals. A breach is a HIPAA business associate event multiplied across clients, and the clients' own contracts pass the notification costs back to the vendor. Payment flows — lockboxes, patient refunds, payer remittances — add a crime exposure that ordinary software companies do not have. This guide covers E&O for coding and billing errors, HIPAA-aware cyber, crime and funds-transfer coverage, False Claims Act defense, and the business associate and client-contract terms that decide who pays when a payer claws back a year of claims.
Who this guide is for
Written for founders, compliance officers, and finance leads at medical billing, coding, and revenue cycle management companies, including the software platforms that automate parts of the cycle. Outsourced billing and coding firms serving physician practices, hospitals, and ancillary providers; Revenue cycle management platforms and AI-assisted coding companies with service components; Credentialing, prior-authorization, and denial-management specialists; Not for the practices themselves — the medical practice guide covers provider-side programs.
The risk profile of a medical billing company
Billing companies sit between providers and payers, and both sides can turn a mistake into a claim. The losses are financial and regulatory rather than bodily, which shapes the program. Key exposures: Coding and submission errors that produce denials, missed timely-filing windows, and payer recoupments the client expects the vendor to absorb; False Claims Act and payer-fraud investigations where the billing company's coding patterns, incentives, or software defaults are alleged to have caused overbilling; HIPAA business associate breaches of PHI across many clients at once, with OCR investigations and state attorney general actions; Misdirected or stolen payments through compromised payer portals, patient refund processes, and lockbox or ACH changes; Contract disputes over collection-rate guarantees, transition failures, and accounts receivable left unworked at termination; Employment claims from a large, often remote, coding and call-center workforce.
Medical Billing Errors and Omissions Insurance for medical billing & RCM companies
The primary policy. It covers the financial loss a client suffers from the billing company's negligent acts, errors, and omissions — denied and uncollectible claims, timely-filing failures, recoupments, and credentialing lapses — and the defense of those claims. The form should define professional services to include coding, billing, collections, credentialing, prior authorization, and any software the company uses to deliver them, and it should include regulatory defense for billing-related investigations, ideally with a sublimit for False Claims Act and payer audit matters. Typically responds to: client claims for lost reimbursement caused by coding, submission, or follow-up errors; defense of payer audits and government billing investigations within the regulatory sublimit; contractual claims arising from collection guarantees where the policy permits.
Cyber Liability (HIPAA-aware) for medical billing & RCM companies
As a business associate, the company owns breach notification obligations to each covered-entity client and usually agrees by contract to pay their costs too. Cyber should cover notification across all affected clients, OCR and state regulatory defense, extortion, business interruption for the company's own platform, and dependent business interruption for clearinghouse and practice-management outages, which have halted billing industry-wide before. Typically responds to: multi-client breach response and notification as a business associate; HIPAA and state regulatory defense and penalties where insurable; ransomware response and interruption of the billing operation.
Crime & Funds-Transfer Fraud for medical billing & RCM companies
Billing companies touch money: payer remittances, patient payments, refunds, and sometimes client bank accounts under limited authority. Crime coverage with client-funds, social-engineering, and funds-transfer fraud insuring agreements responds to employee theft and to fraudulent instructions that redirect payments, and clients increasingly require it with a third-party (client property) extension.
Directors & Officers (D&O) for medical billing & RCM companies
Companies with investors, or those acquired into revenue cycle platforms, face claims over disclosure of compliance problems and the regulatory exposure that follows a False Claims Act matter. D&O defends directors and officers and responds to the derivative and investor claims that accompany public enforcement.
Employment Practices Liability (EPLI) for medical billing & RCM companies
Coding and follow-up teams are large and often distributed across states, with productivity metrics that generate wage-and-hour and retaliation disputes. EPLI covers discrimination, harassment, wrongful-termination, and retaliation claims, and whistleblower retaliation provisions matter in a business where employees may report billing concerns.
Contract and certificate requirements
Provider clients and the health systems behind them require E&O and cyber at stated limits, often naming the client as additional insured on the cyber policy, plus general liability and workers' compensation. Business associate agreements add breach-notification cost allocation, indemnities for HIPAA violations, and sometimes minimum cyber limits scaled to the number of records. Clearinghouse and payer portal agreements carry their own security and indemnity terms. The service agreement decides the E&O exposure. Collection-rate guarantees, denial-rate commitments, and transition obligations should be bounded by a limitation of liability the policy can support, and the agreement should state who is responsible for coding decisions when the provider documents and the vendor codes. The policy's contractual liability and guarantee exclusions should be read against those clauses before signature.
What coverage costs
E&O pricing for a billing company is driven by annual charges or collections processed, specialties served (surgical, behavioral health, and laboratory billing draw more scrutiny), coding certification and audit practices, the share of revenue from government payers, client count and concentration, and claims and investigation history. Companies that run independent coding audits and document them have a measurably better placement. Cyber pricing follows record volume, the number of covered-entity clients, security controls, and clearinghouse dependencies; crime pricing follows the payment flows the company controls and the verification procedures around them. As of 2026, the market for billing companies is established, but False Claims Act defense sublimits vary widely between forms and are worth more attention than the headline limit.
What underwriters will ask for
Underwriters evaluate coding governance, data handling, and payment controls, in that order. Have ready: Annual charges and collections processed, by specialty and by payer mix, with client count and largest-client share; Coding staff credentials, internal and external audit frequency, and how coding disputes with clients are resolved; Standard service agreement, including guarantees, limitation of liability, and termination transition terms; Business associate agreement template and the list of practice-management and clearinghouse integrations; Security program: encryption, access controls, multi-factor authentication, backups, and vendor assessments; Payment flows controlled by the company and the verification steps for banking changes and refunds.
Illustrative example: The modifier that triggered a payer audit
A billing company's software applies a modifier by default on a category of procedures for an orthopedic client. A commercial payer's audit finds the modifier unsupported in most charts and recoups two years of payments. The practice demands reimbursement from the vendor and reports the pattern to its compliance counsel, who raises False Claims Act concerns about the Medicare claims coded the same way. Medical billing E&O responds to the practice's claim for the recouped payments and funds defense of the government inquiry within the regulatory sublimit. The audit trail showing who configured the default and whether the client approved it is the central evidence.
Illustrative example: The clearinghouse outage and the ransomware note
A clearinghouse the company depends on goes offline for weeks after a ransomware attack, halting claim submission for every client. Separately, the company's own file-transfer server is found to have been accessed by the same group, exposing PHI for several practices. Cyber responds to the company's own breach — forensics, multi-client notification, and regulatory defense — and dependent business interruption coverage responds to lost revenue from the clearinghouse outage if the vendor is a scheduled or qualifying dependency. Client contracts decide how much of the clients' loss flows back.
What does medical billing errors and omissions insurance cost?
Pricing follows charges and collections processed, specialties and payer mix, coding audit practices, client concentration, security controls, and claims and investigation history, so there is no standard figure. As of 2026, most billing companies carry E&O and cyber at limits their largest client contracts require, with a regulatory sublimit for billing investigations and crime coverage sized to the payments they control.
Does E&O cover a False Claims Act investigation?
Only to the extent the form includes regulatory or billing-investigation coverage, which is usually a defense-cost sublimit. Fines, penalties, and multiplied damages are generally not insurable. Ask for the sublimit explicitly and confirm whether it responds to subpoenas and civil investigative demands, not only to filed complaints.
Are we responsible for a breach of our client's patient data?
As a HIPAA business associate, yes, for data in your possession, and your business associate agreements usually make you responsible for the client's notification costs as well. Cyber coverage should be sized to the total records across all clients and should name clients as additional insureds where contracts require it.
Do billing companies need crime insurance?
Yes if they handle payer remittances, patient payments, refunds, or any client banking authority. Crime insurance with client-funds, social-engineering, and funds-transfer fraud coverage responds to employee theft and to fraudulent payment instructions, and clients often require a third-party extension that covers their money in your hands.
Does using AI-assisted coding change the insurance?
Underwriters ask how the tool is validated, whether a certified coder reviews its output, and who is responsible for its defaults. The E&O professional services definition should include software-assisted services so the policy responds whether an error came from a person or a model, and the Tech E&O part should cover the software itself if clients license it.
Caveats and common gaps
Regulatory and billing-investigation coverage is a sublimit that varies by form, and fines, penalties, and multiplied damages are generally excluded. Guarantee and contractual liability exclusions can remove collection-rate claims unless negotiated. Dependent business interruption coverage requires the clearinghouse or platform to qualify under the policy's definition.
Related guides
Insurance for Medical Practices — the provider-side program your clients carry · Insurance for Healthtech Companies — the broader digital health guide · Insurance for Business Process Outsourcing Firms — outsourced operations with client data and payment flows · Insurance for Remote Patient Monitoring Companies — a neighboring class with Medicare billing compliance exposure · Insurance for Healthcare Staffing Agencies · Professional liability (E&O) coverage · Cyber liability coverage
Frequently asked questions
What does medical billing errors and omissions insurance cost?
Pricing follows charges and collections processed, specialties and payer mix, coding audit practices, client concentration, security controls, and claims and investigation history, so there is no standard figure. As of 2026, most billing companies carry E&O and cyber at limits their largest client contracts require, with a regulatory sublimit for billing investigations and crime coverage sized to the payments they control.
Does E&O cover a False Claims Act investigation?
Only to the extent the form includes regulatory or billing-investigation coverage, which is usually a defense-cost sublimit. Fines, penalties, and multiplied damages are generally not insurable. Ask for the sublimit explicitly and confirm whether it responds to subpoenas and civil investigative demands, not only to filed complaints.
Are we responsible for a breach of our client's patient data?
As a HIPAA business associate, yes, for data in your possession, and your business associate agreements usually make you responsible for the client's notification costs as well. Cyber coverage should be sized to the total records across all clients and should name clients as additional insureds where contracts require it.
Do billing companies need crime insurance?
Yes if they handle payer remittances, patient payments, refunds, or any client banking authority. Crime insurance with client-funds, social-engineering, and funds-transfer fraud coverage responds to employee theft and to fraudulent payment instructions, and clients often require a third-party extension that covers their money in your hands.
Does using AI-assisted coding change the insurance?
Underwriters ask how the tool is validated, whether a certified coder reviews its output, and who is responsible for its defaults. The E&O professional services definition should include software-assisted services so the policy responds whether an error came from a person or a model, and the Tech E&O part should cover the software itself if clients license it.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.