A clinician trusted your output. The patient’s injury is now your claim.Founded by a software developer who runs an AI app.
We insure AI scribes, symptom checkers, triage tools, clinical decision support and remote monitoring with technology E&O that can answer a patient injury, plus cyber for the records you hold and product liability where the software is a regulated device.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O runs an app with an AI coach of his own.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, owns and runs TrainRec, a fitness app with a built-in AI coach, and has placed insurance for AI apps. Insuring his own taught him how an underwriter reads a model. Personal guidance from an AI reads more like the work of a professional than like software, technology E&O forms commonly exclude bodily injury, and not every form will add it back. So whether your app answers money, health, hiring or farming questions, the gap between what it says and what the policy covers gets read by someone who has had to close it for his own product.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What digital health businesses actually need.
Technology E&O with contingent bodily injury
Claims that your software’s output was wrong, including a patient injury that followed when a clinician or the patient relied on it, once contingent bodily injury is added.
Without it — The standard tech E&O form excludes bodily injury, and patient injury is the claim a hospital contract asks you to indemnify. Ask for the grant by name.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — Patient records, recordings and transcripts are the data a breach is about. Where you are a business associate, a provider’s contract will name you in the notification and the regulator’s questions.
Product liability
Injury caused by a product, which a regulated software device can be.
Without it — If the FDA treats your software as a device, the injury claim is a product claim, and software coverage may not answer it.
Professional liability for clinicians you employ
Care given by licensed clinicians your company hires or contracts, such as a telehealth practice you own.
Without it — A platform that employs clinicians is also a care provider, and tech E&O is not written for malpractice.
General liability
Third-party bodily injury and property damage. It is the line nearly every contract names by default.
Without it — The certificate a hospital asks for first. Read it for a professional services or technology exclusion, which is where a patient injury claim usually gets pushed off it.
Directors & officers
Protects the personal assets of the people running the company when they are sued over a management decision. It applies to private companies and nonprofit boards, not just public ones, which is a common and expensive misunderstanding.
Without it — A funding round, a board and an attorney general asking about your accuracy claims are all D&O territory.
What the regulators actually wrote down.
Clinical decision support software for clinicians is excluded from the FDA’s definition of a device only if it meets all four criteria in section 520(o)(1)(E) of the FD&C Act, including that it is intended to let the clinician independently review the basis for its recommendations so the clinician does not rely primarily on them.
U.S. Food and Drug Administration, Clinical Decision Support Software, guidance for industry and FDA staff (issued January 29, 2026) · checked 2026-11-01
FDA’s guidance says a software function that gives a specific preventive, diagnostic or treatment output or directive fails the criteria, and that FDA weighs the level of automation and how time-critical the clinician’s decision is, because automation bias (over-reliance on an automated suggestion) rises when there is no time to weigh other information.
U.S. Food and Drug Administration, Clinical Decision Support Software, guidance for industry and FDA staff (issued January 29, 2026) · checked 2026-11-01
FDA states that its existing digital health policies still apply to software that meets the device definition, including software intended for patients or caregivers.
U.S. Food and Drug Administration, Clinical Decision Support Software (guidance page, content current as of January 29, 2026) · checked 2026-11-01
In an Assurance of Voluntary Compliance the Texas Attorney General alleged that Pieces Technologies, whose generative AI summarizes, charts and drafts clinical notes for doctors and nurses inside the electronic health record, advertised a “critical hallucination rate” and “severe hallucination rate” of “<.001%” and “<1 per 100,000,” and that those representations may have violated the Texas Deceptive Trade Practices Act as false, misleading or deceptive. Pieces denied any wrongdoing and the Assurance is not an admission.
State of Texas v. Pieces Technologies Inc., Assurance of Voluntary Compliance (dated August 21, 2024; submitted for approval in Dallas County) · checked 2026-11-01
The Pieces Assurance runs five years. It requires clear disclosure of what any AI output metric means and how it was calculated (or an independent auditor’s substantiation), and documentation for every customer of known or reasonably knowable harmful uses and limitations, including the risk of physical or financial injury from inaccurate output.
State of Texas v. Pieces Technologies Inc., Assurance of Voluntary Compliance (dated August 21, 2024; submitted for approval in Dallas County) · checked 2026-11-01
The Texas Attorney General announced the Pieces settlement in September 2024 as the first of its kind in healthcare generative AI.
Texas Attorney General, Attorney General Ken Paxton Reaches Settlement in First-of-its-Kind Healthcare Generative AI Investigation (September 2024) · checked 2026-11-01
A person is a HIPAA business associate when, acting on behalf of a covered entity and not as its workforce, it creates, receives, maintains or transmits protected health information for a regulated function, and a subcontractor that does so for a business associate is included.
45 CFR 160.103, definition of business associate · checked 2026-11-01
The Federation of State Medical Boards’ April 2024 policy says state boards regulate the licensed physicians who use AI tools rather than the tools, and that the physician is ultimately responsible for the use of AI and should be held accountable for any harms that occur.
Federation of State Medical Boards, policy on the responsible and ethical incorporation of artificial intelligence into clinical practice (adopted April 2024), Section III · checked 2026-11-01
HHS guidance on health apps says a developer is likely not a HIPAA business associate when the consumer chose the app independently and decides alone whether to send data to a provider.
HHS Office for Civil Rights, Health App Use Scenarios & HIPAA (February 2016), as summarized by Hunton Andrews Kurth, March 1, 2016 · checked 2026-10-23
On at least one major insurer’s technology E&O form, contingent bodily injury is not available as a carve-back to the bodily injury exclusion, so the coverage has to come from a market that offers it.
Kevin Kelsey, agency placement experience (technology E&O form, insurer not named) · checked 2026-10-29
In placements of AI apps this agency has seen that an underwriter reads an AI that gives personal guidance more like a professional than like software, which changes the policy and the questions.
Kevin Kelsey, agency placement experience (underwriter feedback, insurer not named) · checked 2026-11-01
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Most common
A patient is harmed after a clinician relies on your AI note, summary or recommendation
Covered by Technology E&O with contingent bodily injury
The patient sues the clinician or health system first, and their malpractice insurer later looks to you through an indemnity clause. Your tech E&O usually excludes bodily injury, so without contingent bodily injury the promise has no policy behind it.
Less common, severe
A symptom checker or triage tool tells a patient to wait
A disclaimer helps the defense and does not stop the filing. Whether the claim lands on software coverage or product coverage depends on whether the tool is a regulated device.
Less common, severe
Your marketing says the AI is highly accurate and an attorney general disagrees
Covered by Technology E&O or D&O, depending on whether regulatory defense is included
The Texas settlement with Pieces Technologies began as a state consumer protection inquiry into accuracy claims. Many forms limit coverage for regulatory proceedings, so read that section.
Common
Patient data is exposed or shared without permission
Covered by Cyber, first-party response and privacy liability
As a business associate you answer directly for the data. Some cyber forms exclude regulatory fines or claims from data you collected without proper consent, so read both.
What our digital health clients ask us.
A patient is hurt after a clinician relied on our software. Who gets sued?
Usually the clinician, practice or health system first, and their malpractice insurer pays the early costs. That insurer, or the customer’s contract, then looks to you through an indemnity clause, a contribution claim or a product claim if the software is a device. Your own tech E&O is the policy that should answer, and it usually excludes bodily injury unless contingent bodily injury is added.
What is contingent bodily injury for a digital health company?
It lets tech E&O respond when someone says they were physically harmed by relying on your software, though you never touched them. Here the person relying may be a clinician, so the wording should reach injury that follows a professional’s reliance on your output. It is usually a sublimit, a smaller limit inside the main one, and on at least one major tech E&O form it is not offered, so the market is chosen for it.
Is our clinical software an FDA-regulated medical device?
It depends on what it does and who it talks to. Under section 520(o)(1)(E) of the FD&C Act, clinical decision support for a clinician is not a device only if it meets four criteria, including that the clinician can independently review the basis for each recommendation. FDA’s January 2026 guidance says a specific diagnosis or treatment directive, or support for time-critical decisions, does not qualify, and patient-facing software stays under FDA’s other device policies.
If our software is a device, what changes for insurance?
You add product liability, because a regulated device is a product and an injury claim against it is a product claim. Clearance status, device class, clinical evidence and your complaint and recall process then drive the underwriting, the same questions a hardware maker answers. Ask whether the tech E&O and the product liability sit with one insurer or two, since a gap between them is where an injury claim gets argued.
Are we a HIPAA business associate, and does it change our insurance?
If you create, receive, maintain or transmit patient information for a provider or health plan, yes, and the provider will want a business associate agreement (a BAA). An app a consumer chooses alone usually is not one. The BAA makes you directly answerable for that data, so a breach lands on cyber and on any privacy section of your tech E&O, and the provider’s contract will say who pays for notification.
What did the Texas Attorney General’s 2024 settlement with Pieces Technologies say?
Texas alleged that Pieces, whose AI drafts clinical notes inside hospital records, advertised a critical hallucination rate under 0.001% in ways that may have been misleading. Pieces denied wrongdoing. The five-year agreement requires it to explain how any accuracy number is defined and measured, and to tell customers about known risks, including physical injury from inaccurate output. Treat any accuracy figure in your own marketing as something a regulator may ask you to prove.
A hospital wants us to indemnify it for patient harm. What should we check?
Read what you promise to defend and pay, then check that your insurance answers the same thing. Hospital and health system agreements commonly make the vendor indemnify for claims from the product, and patient injury is one of them. If your tech E&O excludes bodily injury, or limits it to a sublimit smaller than the promise, you hold a commitment nothing stands behind. Send us the agreement before you sign.
Does our policy cover a wrong AI output, such as a note that invents a medication?
Do not assume so. A tech E&O form may exclude or limit claims from generative AI, and many exclusions sit in endorsements, not in the main form. Ask in writing whether AI output is covered in plain words, whether the contingent bodily injury grant reaches it, and whether defense costs erode the limit. Describe what the model does and which vendor’s model you call, because the answer follows from that.
We make or use an AI medical scribe. Where does the liability sit?
The clinician signs the note and stays responsible for it, which is why the practice’s malpractice carrier is usually first in line. The scribe vendor’s exposure is the contract promise, the accuracy it advertised and the recordings and transcripts it holds. Which of the vendor’s policies answers depends on the harm, and the guide walks through each.
What will the underwriter ask a digital health app?
Whether the software suggests or decides, who reviews its output before it reaches a patient or the chart, which model or vendor sits underneath, and whether outputs are logged and can be replayed. Then patient counts, revenue, states and countries, FDA status, any clearance, hospital contracts with indemnity or insurance clauses, a BAA, and prior claims. An AI that gives patient-specific guidance reads more like a clinician than like software.
Which NAICS codes does this page cover?
Software and platform companies in health usually sit in 513210 Software Publishers, 541511 Custom Computer Programming Services, 541512 Computer Systems Design Services or 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services. A company that makes a device with software uses 339112 Surgical and Medical Instrument Manufacturing, and a remote monitoring or telehealth service may fall under 621999 All Other Miscellaneous Ambulatory Health Care Services. Use the code for what you earn revenue from.
We are a telehealth platform. Which policies apply?
It depends who employs the clinicians. If your company hires or contracts them, you need professional liability for their care plus tech and cyber policies for the platform. If you only supply software to independent practices, tech E&O with contingent bodily injury is the center and the practices carry their own malpractice. Many platforms are both, and the line between them is where gaps hide.
How is this different from a fitness or wellness app?
A fitness app’s user follows a plan and hurts themselves, so the claim starts with the user. In digital health a professional usually stands between your output and the patient, so the claim starts with the clinician’s malpractice insurer and reaches you through a contract. The regulatory layer is heavier too: FDA device status, HIPAA and state accuracy enforcement. The fitness page covers the version without that layer.
We built the product with AI coding tools. Does that matter?
It changes the questions more than the policy. Insurers ask who reviewed the code and the security settings before the app held patient data, and a health product holds the most sensitive data there is. The liability is the same as for any software you ship.
We plan to launch outside the US. Does our insurance follow?
Not automatically. Many tech E&O policies only promise to defend claims brought in the US or Canada, and health data from Europe is a special category under the GDPR. Check where claims may be brought and whether cyber answers foreign privacy laws before the launch.
Where can I see the other industries you insure AI apps for?
The hub lists the AI app pages by industry, including finance, legal, hiring, education and companion apps. Each one explains the claim that industry actually produces and the policy that is supposed to answer it.
Guides on digital health.
- AI Medical Scribe LiabilityAn AI scribe drafts the note and the clinician signs it. Here is who the medical boards and state laws hold responsible, how recording consent and a HIPAA agreement fit in, and what the practice’s malpractice policy and the vendor’s tech E&O each answer.
- Bodily Injury vs Contingent Bodily InjuryGeneral liability pays for injuries you cause by accident, and E&O pays for money lost to your mistakes. An injury caused by a mistake in your app, software or advice falls between them, and contingent bodily injury on the E&O is how that gap is closed.
- Insurance for an App Launching WorldwideAn app store launch puts your app in front of users in dozens of countries on the first day. Your tech E&O may only defend claims filed in the US or Canada, and your cyber policy has to handle European privacy rules, where health and fitness readings are a special category of data.
- Vibe-Coded App InsuranceA vibe-coded app carries the same liability as any other, and the documented failures are security ones: open databases, exposed keys and an agent that deleted data. Here is which policy answers which failure, what the AI tool providers say about who is responsible, and what to check before you buy.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.