Insurance for Telehealth Platforms in California

Telehealth Platforms in California: what changes

Telehealth Platforms: local operating decisions in California

The product may handle health information, connect a patient to a provider, or influence a care workflow. Availability and data integrity matter alongside privacy, and the technology company may not be the licensed clinical provider. The state-specific review should ask where the work, employees, contractors, customers, and systems actually sit — not just where the company is incorporated. For this category, platform outages, video and audio failures, or scheduling errors that interrupt or prevent a scheduled visit and breach and ransomware exposure on protected health information exchanged during and after visits should be documented separately so the advisor can distinguish a service error, a privacy event, an employment claim, and a physical loss.

Coverage and contract choices for Telehealth Platforms in California

State the company's role precisely — software vendor, service provider, or clinical operator — then coordinate cyber, technology E&O, professional or medical liability where applicable, and contractual HIPAA obligations without assuming HIPAA applies to every vendor in the same way. Health-system, payer, and large-employer contracts drive the telehealth insurance program. A business associate agreement imposes HIPAA-shaped duties on protected health information exchanged through the platform, and the insurance exhibit typically requires technology E&O and cyber at stated limits — often $1 million to $5 million, higher for major enterprise deals — plus evidence of a security program. Where the platform delivers or coordinates care, customers also ask how medical professional liability is arranged for the clinicians and whether the customer is named as an additional insured, so the program has to answer both the technology and the clinical questions. The practical choice is whether technology e&o + cyber (combined form) is sufficient for the promised work or needs to be coordinated with cyber, crime, EPLI, workers' compensation, or another layer. California Labor Code §3700 requires an employer with one or more employees to carry workers' compensation, subject to the legal definition of employee.

Workers' compensation is mandatory from the first employee

Under California Labor Code §3700, every employer with at least one employee must carry workers' compensation insurance — there is no minimum headcount exemption. Operating without it is a criminal offense and can lead to stop-work orders and penalties. Even companies with a single California hire, including remote employees, need a policy in place.

CCPA/CPRA privacy obligations

The California Consumer Privacy Act, as amended by the CPRA, applies to for-profit businesses that meet at least one threshold set by the current statute, including revenue, personal-information volume, or revenue from selling or sharing personal information. Those thresholds are adjusted periodically, so confirm the current applicability rules in the California Attorney General's guidance before relying on a number. Covered businesses face consumer rights requests, disclosure duties, and a private right of action for certain data breaches — a direct driver of cyber liability exposure.

Breach notification duties

California Civil Code §1798.82 requires businesses to notify California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification costs, credit monitoring, forensics, and legal guidance for exactly this kind of event are core components of a cyber liability policy's breach-response coverage.

Illustrative local scenario: California workflow and data exposure

Illustrative scenario: A telehealth platform working through a team or client operation in Los Angeles, the San Francisco Bay Area, or another California market encounters a deadline-sensitive interruption: a scheduling or patient-communication integration sends the wrong workflow to a provider while a misconfigured storage bucket exposes a limited set of health records. The event also raises a California question about employee coverage, private information, or a customer notification. The advisor would first preserve facts and separate the service allegation from the security or funds event. Technology E&O + Cyber (combined form) may address the professional or technology promise, while cyber, crime, workers' compensation, or another policy responds only if its own insuring agreement, limits, and exclusions fit the facts.

State underwriting guidance for Telehealth Platforms

Prepare data-flow and business-associate details, clinical responsibility matrix, provider contracts, uptime and escalation terms, access controls, breach plan, and any clinical or patient-safety review process. State underwriting is fact driven: California's privacy and breach rules apply according to the data the business holds and the company's activities; they do not turn every business into a regulated financial institution. The reviewer should see how the controls described in the application operate for this category rather than receiving a generic statement that the business is compliant. Have ready: Employee and contractor locations, role classifications, and payroll or headcount for California; A short description of the category's primary exposure: Platform outages, video and audio failures, or scheduling errors that interrupt or prevent a scheduled visit; The state data map, retention practice, access controls, and incident-response contact path; Representative customer contracts, certificates, indemnities, and requested limits; Recent claims, incidents, security assessments, and the controls that changed afterward.

The risk profile of a telehealth platform

Telehealth risk lives at the boundary between a technology failure and a care failure, and the hardest claims are the ones where a patient cannot tell — or does not care — which one caused the harm. Key exposures: Platform outages, video and audio failures, or scheduling errors that interrupt or prevent a scheduled visit; Breach and ransomware exposure on protected health information exchanged during and after visits; HIPAA business-associate obligations flowing down through every health-system, payer, and employer contract; Allegations that the platform, not the clinician, contributed to a delayed or missed diagnosis; Clinician licensing and credentialing exposure as care crosses state lines; Prescribing and e-prescribing workflow failures within the platform; Employment and securities exposure that scales with funding and enterprise contracts.

Technology E&O + Cyber (combined form) for telehealth platforms

The foundation of a telehealth program. Technology E&O answers when the platform itself fails a customer — an outage during scheduled visits, a scheduling engine that double-books or drops appointments, a workflow defect — and the cyber side funds breach response and third-party liability when protected health information is exposed. Because a telehealth incident is frequently both a service failure and a data event at once, a single combined form avoids the coverage gap two separate carriers create. Typically responds to: customer claims for financial loss from platform outages, scheduling failures, or workflow defects; breach response for protected health information: forensics, notification, and regulator communications; ransomware and cyber-extortion response and recovery; network-security and privacy liability defense, including HIPAA-related proceedings within the policy's terms.

Medical / Clinical Professional Liability (coordination) for telehealth platforms

This is the exposure that makes telehealth distinct, and it is critical to get right: your technology E&O does not cover clinical negligence. When the care itself is alleged to be substandard, medical professional liability responds — and depending on your model, that coverage sits with the individual clinicians, with a professional group, or is arranged at the platform level for employed or contracted providers. The failure mode to avoid is a patient claim naming both the clinician and the platform, where the medical policy and the technology policy each argue the other should answer. An advisor maps who carries clinical liability and how the platform is added or protected before that seam becomes a claim.

Directors & Officers (D&O) for telehealth platforms

Telehealth companies operate in a regulated, fast-moving space and raise institutional capital, both of which expose founders and directors personally. D&O protects their assets against investor, regulator, and creditor claims, and most term sheets require it at closing. Given the regulatory backdrop, the investigation-coverage terms warrant close review.

General Liability & Property (BOP) for telehealth platforms

Premises liability and coverage for the company's own equipment, plus the general-liability certificate that landlords and enterprise procurement require as a matter of course. It clears routine contracting friction ahead of a health-system or employer deal.

Employment Practices Liability (EPLI) for telehealth platforms

Telehealth companies scale clinical, engineering, and operations teams quickly, and often manage large contracted-clinician networks, which broadens discrimination, harassment, wrongful-termination, and classification exposure. EPLI funds the defense and settlement and is commonly packaged with D&O.

Workers' Compensation for telehealth platforms

Required in every state where the platform employs staff, including remote clinical and support hires. Multi-state telehealth teams should confirm the policy tracks each state where employees actually work.

Contract and certificate requirements

Health-system, payer, and large-employer contracts drive the telehealth insurance program. A business associate agreement imposes HIPAA-shaped duties on protected health information exchanged through the platform, and the insurance exhibit typically requires technology E&O and cyber at stated limits — often $1 million to $5 million, higher for major enterprise deals — plus evidence of a security program. Where the platform delivers or coordinates care, customers also ask how medical professional liability is arranged for the clinicians and whether the customer is named as an additional insured, so the program has to answer both the technology and the clinical questions. Because care crosses state lines, contracts and diligence probe clinician licensure and credentialing as well as insurance, and the two intersect: an advisor confirms that the platform's technology E&O, its cyber form, and the clinicians' medical professional liability collectively cover the way care actually flows. A OnePark Risk advisor reads the insurance exhibit and business associate agreement against your policies so limits, additional-insured language, and coverage triggers align with what you have promised before go-live.

What coverage costs

As of 2026, telehealth pricing sits above generic SaaS because the platform operates at the edge of care delivery. Carriers underwrite the care model — asynchronous messaging is a lighter exposure than on-demand urgent care or prescribing — along with visit volume, the size and structure of any clinician network, the volume of protected health information, funding stage, and security controls. The closer the platform is to a real-time clinical interaction, the more scrutiny the technology E&O and any platform-level medical liability receive. Security and reliability posture move the premium directly: uptime engineering, multi-factor authentication, environment segregation, tested backups, and a rehearsed incident-response plan are underwriter priorities, because both an outage and a breach are live exposures here. For context on the data side, IBM's Cost of a Data Breach Report 2026 put the global average breach cost at $4.99 million, and healthcare-related incidents consistently rank among the most expensive in that study given their notification obligations and record sensitivity. A OnePark Risk advisor benchmarks the specific program across carriers active in telehealth and coordinates the technology and clinical layers, rather than quoting a single figure — because the way the medical and technology coverage fit together, not any one premium, is what determines whether a patient claim is actually covered.

AI exposure note

If the platform uses AI for triage, symptom checking, note-taking, or any recommendation a clinician or patient acts on, disclose it during underwriting and examine how your technology E&O form treats algorithmic error — and where the line falls between a technology defect and a clinical judgment. AI that touches triage is exactly the kind of feature carriers are addressing with new exclusions and affirmative grants, and the interaction between an AI recommendation, the clinician's decision, and the two liability policies is precisely the seam an advisor needs to close in advance.

Illustrative example: The outage during appointment hours

A telehealth platform serving a large employer suffers a video-infrastructure failure during peak morning appointment hours. Hundreds of scheduled visits cannot connect for several hours; some patients cannot be rescheduled that day, and the employer customer demands compensation for the service failure and the disruption to its workforce. Technology E&O responds to the employer's financial-loss claim, funds defense, and supports resolution; the placement work that defined the platform's service commitments and uptime obligations is what shapes how the policy answers, underscoring why the care and reliability model matters at underwriting.

Illustrative example: The disputed remote visit

A patient seen through an on-demand visit later alleges a condition was missed and names both the treating clinician and the platform, claiming the platform's intake workflow failed to surface information that would have changed the assessment. The clinician's medical professional liability answers the clinical-negligence allegation, while the platform's technology E&O responds to the claim about the intake workflow; the value of coordinating the two in advance is that neither carrier can simply point at the other, and the platform's role is defined before the dispute rather than during it.

Illustrative example: Protected data exfiltrated

An attacker gains access to a telehealth platform's environment and exfiltrates visit records and protected health information across multiple payer and employer customers before demanding payment to prevent publication. The cyber side of the combined form funds the incident-response firm, negotiation, forensics, notification across every affected population, and business-interruption loss — and produces the reports each customer's business associate agreement requires, which is why the carrier's panel should be engaged from the first hour.

Do telehealth platforms in California need workers' compensation insurance?

California requires workers' compensation insurance for every employer with at least one employee (Labor Code §3700) — including a single remote hire in the state. If your telehealth platform has employees in California — including remote hires — a workers' compensation policy should be in place before their first day.

What data-security rules apply to a telehealth platform in California?

California's CCPA/CPRA applies to for-profit businesses meeting revenue or data-volume thresholds and includes a private right of action for certain breaches; Civil Code §1798.82 separately requires breach notification to affected residents. Cyber liability insurance complements these obligations by funding breach response — forensics, notification, legal guidance, and liability defense — when an incident happens despite your controls.

Does OnePark Risk work with telehealth platforms in California?

Yes. Licensed in New York, California, Delaware, Massachusetts, Pennsylvania, New Jersey, Nevada, Florida, and Virginia. Access to more than 100 major insurance carriers and excess lines carriers throughout the country.

What should telehealth platforms in California decide first?

Start by mapping the service promise and the data, systems, people, or funds involved. For this category, platform outages, video and audio failures, or scheduling errors that interrupt or prevent a scheduled visit is a useful starting point; then compare technology e&o + cyber (combined form) with cyber, crime, employment, and general-liability needs rather than buying a state label as a substitute for an exposure review.

How does California privacy law affect telehealth platforms?

California's CCPA/CPRA applies to for-profit businesses meeting revenue or data-volume thresholds and includes a private right of action for certain breaches; Civil Code §1798.82 separately requires breach notification to affected residents. The practical question for telehealth platforms is which records it owns, licenses, stores, or can access and which client or vendor contract allocates response duties. California's privacy and breach rules apply according to the data the business holds and the company's activities; they do not turn every business into a regulated financial institution.

What should a telehealth platform prepare before requesting a California quote?

Prepare data-flow and business-associate details, clinical responsibility matrix, provider contracts, uptime and escalation terms, access controls, breach plan, and any clinical or patient-safety review process. Also bring the relevant state employee count and work locations, the first-party and third-party limits requested by clients, and any open claims or incidents. A certificate can evidence coverage, but it cannot broaden a policy beyond its wording.

When is workers' compensation required for a telehealth platform in California?

California requires workers' compensation insurance for every employer with at least one employee (Labor Code §3700) — including a single remote hire in the state. Confirm who is legally an employee, where the work is performed, and whether any owner or contractor classification changes the analysis. Do not treat a client certificate request as a substitute for state legal advice.

How much does insurance cost for a telehealth platform?

There is no flat rate. As of 2026, pricing turns on the care model, visit volume, the size and structure of any clinician network, the volume of protected health information, funding stage, and security and reliability controls — on-demand and prescribing models price above asynchronous messaging. Many telehealth companies structure technology E&O and cyber at $1 million to $5 million driven by their enterprise customers' insurance exhibits, with medical professional liability coordinated separately; the right way to size premium is to benchmark the full program across several carriers rather than rely on a single quoted number.

Does technology E&O cover a malpractice claim against our clinicians?

No. Technology E&O answers when the platform or software fails; clinical negligence is the province of medical professional liability, which sits with the clinicians, a professional group, or is arranged at the platform level depending on your model. The critical work is coordinating the two so a patient claim naming both the clinician and the platform does not fall into the gap between the policies.

What insurance do enterprise and payer customers require from a telehealth platform?

Typically technology E&O and cyber at stated limits (commonly $1 million to $5 million, higher for large deals), evidence of a security program, and confirmation of how medical professional liability is arranged for the clinicians — often with the customer named as an additional insured. The insurance exhibit and business associate agreement together are the checklist; review them with your advisor before signing.

How does clinician licensing across state lines affect our coverage?

Licensing and credentialing are operational and legal obligations the platform manages, but they intersect with insurance: an advisor confirms that the technology E&O, cyber, and clinicians' medical professional liability collectively cover care as it actually flows across states. Gaps tend to appear where the care model and the coverage model were designed separately.

Do we need technology E&O and cyber as separate policies?

For telehealth, a combined form is usually better: one carrier and one set of definitions, so an incident that is simultaneously an outage and a data breach — a common pattern here — does not trigger two carriers arguing over which responds.

When does a telehealth startup need D&O?

At the latest when institutional capital arrives, as most term sheets require it at closing. Because telehealth operates under active regulatory attention, many founders put a modest D&O policy in place earlier and scale limits each round.

Can OnePark Risk coordinate our technology and medical liability coverage?

Yes — that coordination is central to what an advisor does for a telehealth company. We map how care flows, confirm who carries clinical liability, align the technology E&O and cyber limits with your enterprise contracts, and flag the seams where a patient claim could otherwise fall between the medical and technology policies.

About this guide

Coverage descriptions are educational; whether any policy responds depends on the specific form, endorsements, limits, exclusions, and the facts of a claim.

Sources

• California Department of Industrial Relations — Workers' Compensation FAQs — Confirms the one-or-more-employee workers' compensation rule.
• California Attorney General — California Consumer Privacy Act applicability — Current official applicability guidance, rights, and the limited private right of action; confirm periodically because statutory thresholds can be adjusted.
• California Attorney General — Data Security Breaches — Links the business breach-notice requirements and official guidance.