Medical practice insurance in Colorado starts with malpractice coverage but does not end there. Colorado makes financial responsibility a condition of licensure for physicians and dentists, and the statute’s first option is a commercial professional liability policy. That policy is built for patient care claims. It is not built for a patient who falls in your waiting room, a fire that closes your office, a breach of patient records, or an employee lawsuit. A business owners policy (BOP) does not close the gap on its own: it can bundle general liability, property, and business income coverage, but it does not include professional liability or workers’ compensation.
For a Denver-metro practice, the question is which of those gaps your current program leaves open. Below is what Colorado requires, what a malpractice policy does not cover, how HIPAA sets the clock after a breach, what happens to your coverage when you retire or sell, and why quotes differ.
What Colorado Requires Before a Physician or Dentist Can Be Licensed
Under C.R.S. 13-64-301, every physician and dentist must establish financial responsibility as a condition of active licensure. For a physician, the minimum is $1 million per incident and $3 million annual aggregate. For a dentist, it is $500,000 per incident and $1.5 million annual aggregate. The statute’s first option is commercial professional liability insurance. It also allows a surety bond, a cash deposit, or other security the Commissioner of Insurance accepts. Public employees are not subject to the requirement, and the licensing boards can exempt or reduce it for some classes, such as practitioners who provide limited or occasional services.
Those figures are floors, not recommendations. A hospital or insurance network you work with may ask for more, so read each agreement, and review the limits on your professional liability policy with your broker.
The cap on noneconomic damages in a malpractice claim is also rising. HB24-1472, signed June 3, 2024, raises that cap from $300,000 in yearly steps: $415,000 in 2025, $530,000 in 2026, $645,000 in 2027, $760,000 in 2028, and $875,000 in 2029, with inflation adjustments after that. A higher cap is a reason to revisit your limits at each renewal.
The Everyday Risks a Malpractice Policy Is Not Built For
Malpractice answers claims about the care you give. Most of the other ways a practice loses money are different claims, and each one belongs to a different coverage.
- A hurt visitor. A patient or visitor who is injured in your office, or whose property is damaged there, makes a premises claim. That is general liability, which a BOP includes.
- A closed office. A fire or hail loss that shuts down your practice stops revenue while rent and payroll continue. A BOP can include property and business income coverage, and our guide to how business income coverage works explains waiting periods and what counts as a covered closure.
- Your staff. A BOP does not include workers’ compensation, so staff injuries need a separate workers’ comp policy. A wrongful termination or harassment claim from an employee is an employment claim, which employment practices coverage is written for, not malpractice.
How HIPAA Sets a 60-Day Clock After a Data Breach
HIPAA applies to covered entities, which HHS lists as including doctors and dentists, but only if they transmit health information electronically in connection with a transaction for which HHS has adopted a standard. If you are covered and a breach exposes unsecured patient information, the Breach Notification Rule requires you to notify affected patients without unreasonable delay and no later than 60 days after discovery. A breach affecting 500 or more people must also be reported to HHS within the same 60 days, and one affecting more than 500 residents of a state also requires notice to prominent media outlets there. Smaller breaches are reported to HHS no later than 60 days after the end of the calendar year in which they were discovered.
If the breach happens at a vendor that handles patient data for you, HHS says the practice is still ultimately responsible for making sure patients are notified. Notices go by first-class mail unless a patient has agreed to email. If you lack current contact information for 10 or more patients, you must post a notice on your website home page for at least 90 days or use major print or broadcast media, and keep a toll-free number active for at least 90 days. Ask whether your cyber coverage pays for patient notices, a call line, and regulatory proceedings, and what limit applies. This guide is general information, not legal advice, and your policy forms and the rules that apply to your license control.
What Happens to Your Coverage When You Retire, Sell, or Close
Many professional liability policies are claims-made, which means they respond only to claims reported while the policy is in force. When you retire, switch carriers, or close the practice, the old policy stops responding unless you buy tail coverage, also called an extended reporting endorsement. 1-800-Insurance’s tail coverage guide lists retiring, switching carriers, changing jobs, and closing a business as the usual triggers. It reports that tail coverage costs between 150% and 300% of your final annual premium, depending on your profession, location, claims history, policy limits, and how long an extended reporting period you choose. Some insurers offer free tail coverage after a set number of years or at retirement age, so check your policy before you buy it separately.
Price tail before you sign a sale agreement, set a retirement date, or change carriers.
Why Practice Insurance Quotes Differ, and What Published Figures Suggest
Premiums for a practice turn on your specialty and procedures, where you practice, your limits, your claims history, your headcount, and the value of your equipment, so no published figure is a quote. With that caveat, 1-800-Insurance reports that a BOP, which bundles general liability and property coverage, runs about $70 to $110 a month for a small medical practice. Its dental malpractice guide reports an average dental malpractice premium of about $3,431 a year in 2025 and says general dentists typically pay less than oral surgeons or periodontists. For medical practices, the first guide says professional liability pricing depends heavily on specialty, with obstetrics and surgery costing significantly more than dermatology or psychiatry.
Those are national figures from published guides, not Colorado quotes, and your price can fall outside them. The only number that applies is one built on your own specialty, payroll, and equipment, so ask for a quote before you choose limits. The Insurance Information Institute notes that a BOP does not cover professional liability, which is why a practice prices that policy separately.
Frequently Asked Questions
What insurance does a Colorado medical or dental practice need?
A Colorado physician or dentist needs professional liability coverage or another approved form of financial responsibility under C.R.S. 13-64-301, and a practice with a waiting room, equipment, patient records, and employees also needs general liability, property, cyber, and workers’ compensation coverage. A business owners policy can bundle general liability and property, but it does not include professional liability or workers’ compensation.
How much malpractice insurance does Colorado require for a physician or dentist?
Colorado requires a physician to establish financial responsibility of at least $1 million per incident and $3 million annual aggregate, and a dentist at least $500,000 per incident and $1.5 million annual aggregate, as a condition of active licensure under C.R.S. 13-64-301. The licensing boards can exempt or reduce the requirement for some classes of practitioners, such as those who provide limited or occasional services.
Can a small Colorado medical practice rely on a BOP instead of a malpractice policy?
No. A business owners policy combines property, business income, and liability coverage, but professional liability is not included, so a practice needs a separate professional liability policy for claims about patient care.
How long does a practice have to notify patients after a HIPAA breach?
A HIPAA covered practice must notify affected patients without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. If the breach affects 500 or more people, the practice must also notify HHS within the same 60 days.
Get a quote for your practice.