Insurance & Risk Glossary

Start with the exposure

The SBA business-insurance guide advises assessing risks and describes common policy categories. The NAIC small-business resource provides consumer orientation and routes owners to state insurance departments.

Build an exposure register for professional services, premises, client safety, employment, vehicles, property, cyber events, governance, vendors, business interruption, and contractual obligations. For every exposure, record the insured entity, locations, operations, people, limits, sublimits, exclusions, deductible or retention, effective dates, reporting route, and evidence owner.

Distinguish the main liability policies

Professional liability insurance addresses defined claims tied to professional services. General liability insurance commonly addresses defined bodily injury, property damage, and personal or advertising injury arising from business operations.

Abuse and molestation coverage addresses specified abuse-related exposures under its wording, exclusions, defense, limits, and conditions. It never replaces prevention, screening, supervision, reporting, client rights, or immediate safety action.

Employment practices liability insurance addresses defined employment-related claims. Directors and officers insurance (D&O) addresses defined claims involving organizational leaders and governance decisions. Confirm who is insured and whether an MSO, professional entity, owner, volunteer, or board role is included.

Cover property, interruption, and vehicles

Commercial property insurance addresses covered physical property and causes of loss under the policy. Business interruption insurance can address defined income loss and continuing expense when a covered trigger affects operations. NAIC explains business-interruption and business-owner policies at a general level.

A business owner's policy packages selected coverages. The package label does not guarantee professional, cyber, employment, auto, abuse, flood, earthquake, or every interruption exposure.

Commercial auto insurance covers defined owned-vehicle exposures. Hired and non-owned auto coverage addresses specified hired vehicles and personal vehicles used for business. Verify drivers, vehicle ownership, transportation activities, territories, use, and required limits.

Workers' compensation insurance operates under state systems for work-related injury or illness. Requirements, classifications, monopolistic funds, posting, reporting, and employer-liability components vary by jurisdiction.

Treat cyber insurance as one control

Cyber liability insurance addresses specified first-party and third-party cyber costs, incidents, liabilities, or services. The FTC cyber-insurance guide recommends comparing coverage, response services, provider choices, and incident timing.

Map ePHI, other personal data, systems, vendors, ransomware, social engineering, funds transfer, downtime, notification, forensics, regulatory matters, and dependent business interruption. Insurance cannot replace security risk analysis, access control, backups, incident response, vendor management, or legal notification duties.

Understand trigger and reporting terms

A claims-made policy generally requires a claim to be made during the policy period and may include a retroactive date and reporting conditions. An occurrence policy generally looks to when the covered event occurred. Exact wording controls.

Tail coverage, often an extended reporting period, can allow later reporting of claims tied to covered acts after a claims-made policy ends, subject to terms. It does not extend all coverage or move the retroactive date automatically.

An insurance policy deductible is the insured's defined share before or alongside insurer payment. It differs from a self-insured retention and may apply per claim, occurrence, person, event, or aggregate.

A certificate of insurance summarizes stated coverage at a moment. It does not amend the policy or prove every contract requirement is met. Review endorsements and policy terms, then track expiration and cancellation notice where available.

Connect insurance with continuity

Ready.gov's Business Continuity Planning Suite provides general planning tools. Pair insurance with a business impact analysis, maximum tolerable downtime, recovery objectives, payroll, family communication, clinical safe-stop decisions, data recovery, payer deadlines, and vendor alternatives.

At renewal, compare current operations with the submitted application and policy schedule. New sites, services, entities, clinicians, vehicles, devices, vendors, states, revenue, headcount, or ownership may change the exposure.

Build an incident-routing card for each policy. Include the event types that may trigger notice, insurer or broker contact, required timing, consent before selecting vendors or incurring costs, preservation steps, privileged or confidential routes, law-enforcement questions, and the person authorized to communicate with the carrier. One event may reach several policies. Give each notice its own timestamp and receipt evidence. Reporting an event is not an admission that the policy covers it, and an internal incident classification should never delay emergency, legal, regulatory, or protective action.

Test the card with an unavailable leader and preserve evidence that each alternate owner can reach the approved reporting channel.

A coverage-register example

A fictional practice reviews 22 entity-site-role exposure rows before renewal. Nineteen have a current policy, endorsement or broker confirmation, limits, deductible, effective period, and incident route, or 19/22, 86.4%. Six require continuity tests; five pass, or 5/6, 83.3%.

The three incomplete rows and one failed test remain open by owner and age. These measures show evidence and testing status. They do not establish that an insurer will cover a future claim.

Start or grow your ABA practice with Finni. Confirm current insurance, risk, incident, security, workforce, and continuity capabilities during diligence.