Malpractice, General Liability, and Cyber: The Insurance Stack a Med Spa Actually Needs

Insurance is one of the areas where a structurally sound med spa can still be exposed, because coverage decisions often get made early — sometimes by whoever set up the business entity, sometimes by a broker who’s more familiar with retail or hospitality risk than clinical risk. A policy that looks comprehensive on paper can leave real gaps once you understand what a med spa actually does.

The Coverage Layers That Actually Apply

Professional/malpractice liability covers claims arising from the clinical care itself — a bad outcome from an injectable, a burn from a laser treatment, an allergic reaction. This needs to be held at the level of every provider actually performing procedures, not just a blanket policy assumed to cover the practice as a whole. General liability covers the more conventional risks — a client who slips in the lobby, property damage, third-party injury unrelated to treatment. Cyber liability covers data breaches, which matter more for a med spa than owners often expect, given how much protected health information sits in booking systems, intake forms, and payment processors.

Where the Gaps Usually Show Up

• A general liability policy that owners believe covers clinical incidents, when it explicitly excludes them
• Malpractice coverage that doesn’t extend to every license type performing procedures — particularly newer hires or 1099 providers
• No cyber coverage at all, despite storing patient health information and payment data
• Coverage written for the wrong entity — insuring the management company when the exposure actually sits with the professional entity, or vice versa
• Employment practices liability gaps that matter more than owners expect in an industry with high staff turnover

The entity structure and the insurance structure need to match. A policy written for the wrong entity can leave the one actually exposed with nothing.

How This Connects Back to Structure

Because a compliant med spa typically operates through two entities — the professional entity and the management company — insurance needs to be mapped to that same split. The professional entity generally needs malpractice coverage tied to its providers; the management company generally needs general liability and cyber coverage tied to its operations. Reviewing this alongside your entity structure, rather than treating it as a separate checkbox, is what catches the gaps before a claim does.

If you’re not sure whether your current coverage actually matches your entity structure and provider mix, that’s exactly where we start every engagement.