What you need to know to protect your license, livelihood and practice this year
January is always a good time to review the status of your insurance and compliance policies, but it’s imperative in 2026. This new year brings changes to healthcare legislation, compliance laws, increased regulatory scrutiny and expected economic pressures.
The following checklist of risk-management guidance from CM&F Group will help you identify gaps in risk, compliance or coverage so you can proactively protect your business and those you serve.
Review Your Professional Liability Insurance Coverage for 2026
Your professional liability insurance should reflect how you practice today, not how you practiced when you first purchased your policy. Speak to your insurance agent if you’ve made any changes that can affect your risk exposure.
These include:
- Adding new services
- Expanding autonomy
- Practicing in new states
- Offering telehealth or home visits
- Supervising others
- Shifting to a cash-based or hybrid practice model
- To do: Don’t wait for a claim to identify a coverage gap. By then, it’s too late. Confirm your coverage aligns with your current scope of practice, includes appropriate limits and accounts for any changes in your practice.
Improve Clinical Documentation to Reduce Medical Liability Risk
Clear, consistent documentation remains one of your most effective ways to protect your practice and license from exposures. In the case of a claim, you’ll have to show your documentation supports clinical decision-making, medical necessity and continuity of care.
These days, AI note-taking tools make it easier to ensure your notes tell a complete clinical story, reflect patient communication and align with standards of care. Consider testing how they improve your documentation and save you time.
- To do: Review your note-taking practices and policies a few times a year to identify any issues before they become problems.
Update HIPAA Compliance and Patient Data Security Practices
HIPAA compliance is no longer a one-time online training. As technology evolves and cyber threats increase, PHI privacy and security safeguards must keep pace. Routinely review the steps you take to protect patient privacy. This includes assessing your third-party vendors, who often have access to sensitive patient information as they support billing, scheduling or care delivery.
- To do: Ensure your team uses encryption and multi-factor authentication. Review your HIPAA protocols annually with staff training.
Prepare for Cybersecurity Incidents and Healthcare Data Breaches
Cyber incidents in the healthcare industry are now so common that they’re more a matter of when than if. Ransomware, phishing attacks and data breaches disrupt care, expose sensitive information and trigger regulatory reporting obligations.
Cyber readiness is now an operational concern for your whole team and not just an IT issue. Cyber insurance offers you coverage in case of an incident and a plan in place to help you through the recovery process.
Having a response plan that defines roles, communication steps and recovery priorities helps reduce confusion and downtime when incidents occur.
- To do: Cyber insurance is no longer an option in healthcare. Ensure you have a cyber policy and an incident plan in place.
Stay Compliant with Changing State Practice Laws and Regulations
No matter what license you have, state-level practice laws and supervision requirements continue to evolve, particularly for PAs and NPs clinicians. In many cases, changes create opportunities, but only when you clearly understand the legal requirements.
- To do: Review state-specific regulations at least annually to ensure your practice reflects current policies. If you work with an attorney to do this, be sure it’s a healthcare attorney who understands the requirements in states where you practice.
Build Crisis Preparedness Into Daily Healthcare Operations
The past few years have been marked by disruptions, such as staffing shortages, natural disasters, and supply chain issues that quickly affect patient care.
Effective crisis readiness includes cross-training staff, testing communication protocols and identifying backup systems or vendors for critical functions. It takes some extra thoughtfulness to be prepared for anything, but it also reduces patient safety risks and liability exposure.
- To do: Complete a quick crisis scan of your practice that includes the physical space, parking risks, weather exposures, staff and reliance on technology to identify the top three vulnerabilities that could disrupt operations. Tackle at least one of them in early 2026.
Prepare for 2026 Healthcare Legislative and Regulatory Changes
This year is expected to include significant changes to how healthcare is covered and delivered, thanks to the One Big Beautiful Bill Act. If you accept Medicaid or Medicare, you’re likely to be affected.
Hospitals and health systems are already responding to financial pressure by reducing staff and closing service lines, leaving many rural areas in particular with fewer care options. Of course, coverage disruptions may increase the number of uninsured and underinsured patients seeking care.
It remains unclear whether the $50 billion federal carve-out to stabilize rural healthcare will improve access. It could create opportunities for rural providers, though. Accessing funding requires administrative readiness, grant compliance and coordination with state and local stakeholders.
- To do: Accessing any available rural funding requires administrative readiness, grant compliance and coordinating with state and local stakeholders.
Finally, risk management works best when you build a culture of strong communication. Encouraging staff to raise concerns, report near misses and ask questions without fear of blame helps surface issues early.
With some time, planning, regular training and open communication, your practice can be ready for whatever 2026 throws at us.
Frequently Asked Questions
- How often should healthcare professionals review their professional liability insurance?
Healthcare professionals should review their professional liability insurance at least annually and anytime their scope of practice changes. Adding services, expanding autonomy, practicing in new states, offering telehealth, supervising others, or shifting to a cash-based model can all increase risk exposure and require coverage updates. - Why is HIPAA compliance and cybersecurity a growing risk for healthcare practices?
HIPAA compliance and cybersecurity risks continue to rise due to increased cyber threats like ransomware, phishing, and data breaches. Protecting patient health information (PHI) now requires ongoing staff training, secure technology practices such as encryption and multi-factor authentication, regular vendor reviews, and having cyber insurance and an incident response plan in place. - How do changing state practice laws impact PAs, NPs, and other clinicians?
State practice laws and supervision requirements change frequently, especially for physician assistants and nurse practitioners. Failing to stay current can expose clinicians to compliance violations and liability risks. Reviewing state-specific regulations annually and working with a healthcare attorney can help ensure your practice remains compliant while taking advantage of expanded practice opportunities.
CM&F Group supports healthcare professionals with insurance, compliance and risk-management guidance designed to build strong healthcare businesses. When you’re ready to review your coverage or strengthen your risk strategy, CM&F is here to help.
