Why This Guide Is Different From Individual Indemnity
A great deal of content aimed at doctors focuses on an individual clinician's own professional indemnity, whether that's a locum's personal cover or an employed GP's arrangements through their practice or the NHS. This guide is deliberately different: it addresses the practice itself, as a business entity, and the range of insurance considerations that exist entirely separately from any individual clinician's clinical liability.
A GP surgery or medical practice is, among other things, a premises open to the public, an employer of reception, nursing and administrative staff, a holder of highly sensitive patient records, and an organisation that can be investigated, sanctioned or shut down by its regulator independently of any individual clinician working within it. Each of these carries its own distinct insurance and risk-management considerations that sit outside the scope of personal medical indemnity entirely. For an individual locum's own indemnity and income protection needs, see our Locum Doctor Insurance UK guide. For the equivalent practice-level guide in veterinary medicine, see our Vets Practice Insurance UK guide, which this article follows in structure and approach.
Who This Guide Is For
This guide is written for practice managers, partners and owners responsible for arranging insurance for a GP surgery, medical centre or private medical practice as a business, rather than for an individual clinician seeking their own personal indemnity cover.
Key Terms Explained
- Practice-Level Insurance
- Insurance arranged around the medical practice as a business entity, addressing premises, staff, equipment and organisational liability, distinct from an individual clinician's personal indemnity.
- Clinical Negligence Scheme for General Practice (CNSGP)
- A state indemnity scheme operated by NHS Resolution, covering clinical negligence liabilities arising from NHS general practice work in England since 1 April 2019.
- Care Quality Commission (CQC)
- The independent regulator of health and adult social care in England, responsible for registering and inspecting providers carrying on regulated activities, including most GP practices.
- Employers' Liability Insurance
- Insurance generally required by law for any organisation employing staff, addressing claims from employees injured or made ill because of their work.
- Data Protection Fee
- A fee payable to the Information Commissioner's Office by organisations that process personal information, unless a specific exemption applies.
Core Practice-Level Cover
A medical practice typically needs to think about several genuinely distinct categories of cover, each addressing a different part of the business rather than a single, all-encompassing "practice insurance" product.
| Risk Area | What It Addresses | Distinct From |
|---|---|---|
| Premises and buildings | Damage to the surgery building and fixtures | Clinical liability for treatment |
| Public liability | Injury or damage to patients and visitors from the premises or non-clinical activity | Clinical negligence claims |
| Employers' liability | Claims from staff injured or made ill through their work | Patient-facing liability |
Premises and Buildings Cover
Whether a practice owns or leases its premises, buildings and contents insurance addressing fire, flood, storm and similar damage to the physical surgery is a foundational element of practice-level cover, generally arranged in a similar way to commercial property insurance for any other business premises.
Public Liability for Patients and Visitors
Public liability insurance addresses claims arising from the state of the premises or non-clinical activity, such as a patient slipping on a wet waiting room floor, rather than the content of any clinical advice or treatment given. This is distinct from clinical negligence, which is addressed separately through NHS indemnity schemes or a clinician's own professional indemnity arrangements.
Employers' Liability for Staff
Practices employing reception staff, practice nurses, healthcare assistants or administrative personnel are generally required by law to hold employers' liability insurance, addressing claims from an employee injured or made ill because of their work at the practice. This is covered in more detail in the regulatory section below.
Equipment and IT Systems
Medical practices rely on a mix of clinical equipment, such as diagnostic devices used for routine testing, and IT systems handling appointment booking, prescribing and patient records. Cover addressing theft, accidental damage and breakdown of both categories helps protect against a genuinely disruptive and potentially costly loss.
What Practice Insurance Does Not Typically Cover
Practice-level insurance does not generally substitute for an individual clinician's own clinical negligence indemnity, whether through an NHS scheme or a personal policy. It also does not typically cover professional regulatory proceedings against an individual clinician, such as a General Medical Council investigation, which usually requires separate representation and support arranged by the clinician or their medical defence organisation.
Patient Records and Data Risk
Medical practices hold some of the most sensitive personal data that exists, patient health records, which brings a distinct set of obligations and risks that sit alongside, rather than instead of, traditional practice insurance.
UK GDPR and Data Protection Act 2018
Practices processing patient data must comply with UK GDPR and the Data Protection Act 2018, which set out how personal data, including special category health data, must be handled, secured and processed lawfully.
The ICO Data Protection Fee
Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that process personal information generally need to pay a data protection fee to the Information Commissioner's Office (ICO) unless they are exempt. This is a distinct, separate obligation from arranging insurance and applies regardless of the practice's size.
Cyber and Data Breach Insurance
Given the volume and sensitivity of patient records held digitally, many practices now consider cyber or data breach insurance alongside traditional practice cover, addressing costs that can arise from a data breach, such as incident response, notification obligations and potential regulatory action. Whether this is included within a wider practice policy or arranged separately should always be confirmed directly, rather than assumed.
Records Held on Paper and in Legacy Systems
Some practices, particularly smaller or longer-established ones, still hold a meaningful volume of records on paper or within older systems. These carry their own physical security and business continuity considerations distinct from purely digital data risk, and should be factored into premises and business continuity planning rather than treated as automatically less exposed simply because they are not digital.
Specialist Situations
Certain practice structures and circumstances call for closer attention when arranging insurance.
Single-Handed and Small Practices
A small or single-handed practice carries the same fundamental categories of risk as a larger surgery, premises, staff, patients and records, but often has less capacity to absorb a significant loss without meaningful disruption, making comprehensive cover proportionately more important relative to the size of the business.
Multi-Partner and Larger Practices
Larger practices with multiple partners and a bigger staff team should ensure cover reflects the true scale of the operation, including the number of employees for employers' liability purposes and the full value of equipment and premises across every site the practice operates from.
Practices Sharing Premises or Buildings
Where a practice shares a building with other healthcare providers or unrelated tenants, it's worth clarifying exactly which party is responsible for insuring shared areas such as communal entrances, corridors and car parks, since ambiguity here can complicate a claim if an incident occurs in a shared space.
Private and Non-NHS Practices
Private practices generally cannot rely on NHS indemnity arrangements such as the Clinical Negligence Scheme for General Practice, which is built around NHS general practice work specifically, so private practice businesses and their clinicians typically need to arrange indemnity and practice-level insurance more comprehensively and independently.
Practices Undergoing Expansion or Refurbishment
A practice midway through expanding consulting space or refurbishing its premises faces a temporarily elevated risk profile, with contractors on site and possibly reduced clinical capacity. Notifying the insurer before major works begin helps avoid disputes later over whether resulting damage or disruption was properly covered.
Practices Employing Locums Regularly
Practices that regularly engage locum clinicians should have a clear, consistent process for confirming a locum's own indemnity arrangements before they begin work, rather than relying on informal assumptions that vary locum to locum. See our Locum Doctor Insurance UK guide for the individual clinician's side of this arrangement.
New Practices and Mergers
A newly formed practice, or one going through a merger with another surgery, should treat insurance arrangements as a genuine priority during the transition, ensuring cover is confirmed and in place from the day the new or merged entity begins operating, rather than assuming existing arrangements automatically transfer or combine correctly.
What Affects the Cost?
The cost of practice-level insurance depends on several factors specific to how the business operates, rather than a single standard rate applying uniformly across every practice.
- The size and rebuild value of the practice premises
- The number of staff employed and their roles
- Whether the practice is NHS, private, or a mix of both
- The value of clinical equipment and IT systems insured
- Claims history and years the practice has been trading
- Whether cyber or data breach cover is included
Bundling Cover Types Together
Many insurers offer combined practice policies bundling premises, public liability, employers' liability and equipment cover together, which can often be more straightforward and cost-effective to manage than arranging each type of cover separately with different providers.
Claims History and Risk Management
A practice with a clean claims history and demonstrable risk management, such as clear incident-reporting procedures and regular premises safety checks, can often negotiate more favourable terms than one without this evidence to offer an underwriter.
How to Choose a Policy
- List every category of risk the practice faces: premises, staff, patients, equipment, records and business continuity.
- Confirm what NHS indemnity schemes do and do not cover for your specific practice type.
- Check that employers' liability cover reflects your actual staff numbers and roles.
- Decide whether cyber or data breach cover should be included given the volume of patient data held.
- Compare insurers with genuine experience of healthcare or medical practice risk.
Seek Insurers With Healthcare Sector Experience
Insurers familiar with medical practices are generally better placed to price and structure cover appropriately than a generic commercial insurer unfamiliar with the sector's specific mix of clinical, data and premises risk.
Review Cover Annually as the Practice Changes
Staff numbers, equipment value and services offered can all change meaningfully year to year, so reviewing cover at each renewal, rather than simply accepting an automatic renewal, helps ensure the policy keeps pace with how the practice has actually developed.
Regulatory Obligations for Practices
Medical practices sit within a genuinely distinct regulatory framework compared with most ordinary businesses, and understanding this framework helps clarify where insurance fits alongside separate legal and regulatory obligations.
CQC Registration Is a Legal Requirement
Under the Health and Social Care Act 2008, any person, whether an individual, partnership or organisation, who carries on a regulated activity in England must be registered with the Care Quality Commission, and operating without the required registration means committing an offence. This registration obligation sits entirely separately from, and in addition to, any insurance the practice arranges.
What CNSGP Does and Does Not Cover
The Clinical Negligence Scheme for General Practice, operated by NHS Resolution, provides indemnity for clinical negligence liabilities arising from NHS general practice work in England for incidents occurring on or after 1 April 2019. It does not extend to non-clinical or regulatory matters, non-NHS work, or representation at inquests, General Medical Council hearings or disciplinary investigations, all of which typically still require separate arrangements, whether through a medical defence organisation or other specific cover.
Employers' Liability as a Legal Requirement
Under the Employers' Liability (Compulsory Insurance) Act 1969, most employers, including medical practices with staff, are legally required to hold employers' liability insurance, addressing claims from employees injured or made ill because of their work. This applies to reception, nursing and administrative staff in the same way it applies to employees of any other business.
Data Protection Registration and Obligations
Separately from CQC registration, practices processing personal data generally need to pay the ICO's data protection fee under the Data Protection (Charges and Information) Regulations 2018, unless a specific exemption applies, reflecting the practice's role as a data controller for patient records.
CQC Enforcement Action Against the Practice
Because CQC registers the practice as a "provider," which may be the practice itself as a legal entity rather than any single individual, the CQC can take enforcement action, including warning notices, requirement notices or, in serious cases, cancellation of registration, directed at the practice as an organisation, separately from any professional regulatory action taken against an individual clinician by their own regulator.
Case Studies
Case Study: Waiting Room Injury
A patient trips on a loose floor tile in a busy practice waiting room and is injured. Because the incident relates to the condition of the premises rather than clinical treatment, it is handled as a public liability claim against the practice, distinct from any clinical negligence question, and the practice's public liability cover responds accordingly.
Case Study: A Locum Indemnity Gap Avoided
A practice engages a locum GP to cover a period of staff leave. Before the locum begins, the practice manager confirms in writing that the locum holds appropriate personal indemnity cover for the work involved, avoiding any ambiguity later about whether a clinical dispute arising during that period would be properly covered.
Case Study: IT System Failure Disrupting Appointments
A practice's patient record and appointment system fails unexpectedly, disrupting bookings and clinical access to records for several days. Because the practice's policy includes cover addressing this kind of disruption, the financial impact of the outage is mitigated while the system is restored.
Case Study: CQC Enforcement Action
Following an inspection, the CQC issues a requirement notice to a practice over specific shortfalls identified in its processes. Because this action is directed at the practice as the registered provider, it is addressed at practice level through governance and remedial action, separately from any individual clinician's own professional standing.
Making a Claim
- Notify your insurer promptly once you become aware of a potential claim or incident.
- Gather a clear, factual account of the incident, along with any relevant records.
- Cooperate fully with any investigation your insurer carries out.
- Keep clear internal records of all correspondence throughout the claims process.
- Confirm early whether the matter is a practice-level issue, an individual clinical indemnity issue, or both.
Separating Practice and Individual Clinical Claims
Because practice-level insurance and individual clinical indemnity address different things, it's worth establishing early in any claim which category, or combination of categories, actually applies, since this determines which insurer, indemnity scheme or medical defence organisation should be notified.
Supporting a Claim With Good Documentation
Clear incident records, maintenance logs and correspondence kept as a matter of routine practice consistently make claims easier to assess fairly and efficiently, whatever type of claim eventually arises.
Common Mistakes to Avoid
- Assuming personal medical indemnity or NHS schemes cover the practice's own business risks
- Overlooking employers' liability insurance for reception, nursing or administrative staff
- Not confirming a locum's own indemnity arrangements before they begin work
- Treating CQC registration and insurance as the same thing, rather than separate obligations
- Underestimating the data protection obligations around patient records
- Not reviewing cover as staff numbers or equipment value grow
- Assuming a single "practice insurance" product automatically covers every risk category
- Overlooking business interruption cover for events that stop the practice operating normally
- Forgetting to update the insurer about premises changes, expansion or refurbishment
- Assuming CNSGP or an equivalent scheme covers non-clinical or regulatory matters
Myths vs Facts
- Myth: A GP's personal indemnity covers the practice as a business. Personal indemnity addresses an individual clinician's clinical liability; practice-level risks such as premises, staff and data are separate.
- Myth: The Clinical Negligence Scheme for General Practice covers everything a GP might need. It covers NHS clinical negligence specifically, not regulatory, disciplinary or non-NHS matters.
- Myth: CQC registration is optional for small practices. It is a legal requirement under the Health and Social Care Act 2008 for anyone carrying on a regulated activity in England.
- Myth: Employers' liability insurance is optional if staff numbers are small. It is generally a legal requirement for any practice employing staff, regardless of size.
- Myth: Data protection registration is the same as arranging cyber insurance. The ICO fee is a separate legal obligation from any insurance a practice chooses to arrange around data risk.
- Myth: A locum is automatically covered by the host practice's arrangements. This should always be confirmed directly rather than assumed.
Frequently Asked Questions
Is GP surgery insurance the same as a GP's personal medical indemnity?
No. Personal medical indemnity, or NHS indemnity arrangements such as the Clinical Negligence Scheme for General Practice, address an individual clinician's own clinical liability. Practice-level insurance addresses the business itself: premises, staff, equipment, patient and public liability, and business interruption.
Does the Clinical Negligence Scheme for General Practice cover everything a practice needs?
No. The scheme covers clinical negligence liabilities arising from NHS general practice work. It does not cover non-clinical or regulatory matters, non-NHS work, or representation at inquests, GMC hearings or disciplinary investigations, all of which practices and clinicians typically still need to arrange separately.
Do GP practices need to register with the Care Quality Commission?
Under the Health and Social Care Act 2008, any person, partnership or organisation carrying on a regulated activity in England must be registered with the CQC, and operating without the required registration means committing an offence.
Do medical practices need employers' liability insurance?
Practices that employ staff are generally required to hold employers' liability insurance under the Employers' Liability (Compulsory Insurance) Act 1969, addressing claims from employees who are injured or become ill because of their work.
Do GP practices need to register with the ICO and pay a data protection fee?
Under the Data Protection (Charges and Information) Regulations 2018, organisations that process personal information, including patient records, must generally pay a data protection fee to the ICO unless a specific exemption applies.
Does practice insurance cover a data breach involving patient records?
This depends on the specific policy. Many practices now arrange cyber or data breach cover alongside traditional practice insurance, reflecting the sensitivity of patient records and the practice's obligations under UK GDPR and the Data Protection Act 2018.
Does GP practice insurance cover locums working at the surgery?
Practice insurance and a locum's own indemnity arrangements are generally separate. Practices should confirm what indemnity cover a locum holds before they begin work, rather than assuming the practice's own arrangements automatically extend to cover them.
What happens if a patient is injured on the surgery premises rather than during treatment?
An injury caused by the state of the premises itself, such as a trip on a damaged floor in the waiting room, is generally a public liability matter for the practice, distinct from a clinical negligence claim about diagnosis or treatment.
Can a GP practice be investigated or sanctioned separately from an individual clinician?
Yes. The CQC regulates and can take enforcement action against the registered provider, which may be the practice itself, separately from any professional regulatory action taken against an individual clinician by their own regulator.
Does practice insurance cover business interruption if the surgery cannot open?
Many practice policies can include business interruption cover addressing the financial impact of being unable to operate normally, such as after a fire, flood or serious IT failure, though the specific triggers and limits vary by policy and should be checked directly.
Do private medical practices have different insurance needs from NHS GP practices?
Private practices generally cannot rely on NHS indemnity schemes such as the Clinical Negligence Scheme for General Practice, since these are built around NHS general practice work, so private practice clinicians and businesses typically need to arrange their own indemnity and business insurance more comprehensively.
How do I complain if I disagree with how a practice insurance claim was handled?
Raise a formal complaint with the insurer first and request their final response in writing. If the complaint remains unresolved, or you disagree with the final response, you can refer it to the Financial Ombudsman Service, which provides free, independent dispute resolution for eligible smaller UK businesses.
Complaints and Disputes
If something goes wrong with practice-level insurance, whether over a declined claim, a valuation dispute, or delays in handling, there is a clear route to raise and escalate concerns.
Escalating to the Financial Ombudsman Service
If you remain unsatisfied after your insurer's final response, you can refer your complaint to the Financial Ombudsman Service, which provides free, independent dispute resolution for eligible smaller UK businesses.
Distinguishing Insurance Complaints From Regulatory Matters
A complaint about how an insurer has handled a claim is separate from any regulatory matter involving the CQC or an individual clinician's professional regulator, and each should be pursued through its own correct channel rather than conflated with the others.
References and Further Reading
- Care Quality Commission (CQC) — the independent regulator of health and adult social care in England.
- NHS Resolution — operator of the Clinical Negligence Scheme for General Practice.
- Information Commissioner's Office (ICO) — UK regulator for data protection and the data protection fee.
- Financial Conduct Authority (FCA) — the regulator responsible for overseeing UK insurance providers.
- Financial Ombudsman Service — independent dispute resolution for UK financial services complaints.
| Version | Date | Change |
|---|---|---|
| 1.0 | 15 August 2026 | Initial publication |
Conclusion
A medical practice's insurance needs go well beyond any individual clinician's own indemnity. Premises, staff, patients, equipment, records and the practice's ability to keep operating each carry their own distinct risks, and CQC registration, employers' liability insurance and data protection obligations each sit alongside insurance as separate, non-negotiable requirements rather than optional extras.
Treating practice-level insurance and individual clinical indemnity as two related but genuinely separate checklists, and reviewing both regularly as the practice changes, gives a medical practice a considerably more complete and accurate picture of its actual protection than assuming one type of cover automatically extends to address the other.