Who Carries the Risk When a Remote Consultation Goes Wrong
Picture the claim that keeps a healthtech founder awake. A patient books a video consultation through the platform for a child running a high fever. The empanelled doctor, working through a chat-and-video interface, advises home management and a routine antipyretic. Two days later the child is hospitalised with bacterial meningitis. The family's lawyer does not chase the doctor who earned a few hundred rupees for the consultation. The lawyer serves the funded company whose brand was on the app, whose triage prompt routed the case, and whose registered office is easy to find. That single scenario explains why insuring a teleconsultation business is not the same as insuring a software business, and why founders who assume the doctor's own cover protects them are exposed at precisely the moment a claim turns serious.
India's teleconsultation sector in 2026 is leaner and more clinical than the pandemic-era rush of point apps. The survivors run real medical workflows: full-stack platforms pairing consultation with e-pharmacy, specialty verticals in mental health, dermatology, fertility and diabetes, and corporate-benefit platforms that broker doctor access for employers. What unites them is a structural fact that decides every coverage question. The platform sells a connection, a clinical layer and a record store. The clinical decision belongs to a registered medical practitioner who, in the standard arrangement, is an independent contractor rather than an employee.
The governing instrument is the Telemedicine Practice Guidelines, 2020, notified as an amendment to the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, and now administered through the National Medical Commission. The guidelines fix professional accountability on the registered medical practitioner conducting the teleconsultation. That doctor owes the duty of care, decides whether a condition is even suitable for remote management, and is held to the same diagnostic, prescribing and record-keeping standards as in a clinic. The technology that connects doctor and patient is not, in the ordinary case, the provider of medical services.
That clean legal allocation rarely survives contact with a real dispute. A patient alleging misdiagnosis has a claim against the doctor under the Consumer Protection Act, 2019 (medical services for consideration sit within its scope on the reasoning in Indian Medical Association v V P Shantha) and in negligence. But plaintiffs plead against the deep pocket. They argue the platform held the doctor out as its agent, failed to verify credentials, ran a triage flow that misrouted the case, or suffered an interface failure mid-consultation. Indian courts have not yet built a settled body of teleconsultation precedent that lets a platform exit such allegations early, so even a successful defence burns capital.
The upshot is that a teleconsultation startup faces three exposures the market sells as separate products, and this article takes them in turn: the clinical act of the empanelled doctor, the behaviour of the software when the code rather than the clinician causes harm, and the sensitivity of the health data the platform holds. A founder who has built the risk model on the doctor's individual indemnity alone, where limits often sit between INR 10 lakh and INR 1 crore, has nothing standing behind a paediatric or oncology claim large enough to threaten the company itself.
Stacking Clinical Indemnity: Doctor, Panel and the Platform Wrap
Clinical indemnity (medical professional liability, the malpractice cover of healthcare) answers a claim that negligence in diagnosis, advice, treatment or prescription caused patient harm. A teleconsultation platform that takes this seriously builds the cover in three layers rather than buying a single policy, because no single layer protects every party the claim will name.
The practitioner policy is the base. New India Assurance, United India, ICICI Lombard, HDFC Ergo, TATA AIG and Bajaj Allianz write doctor indemnity on a claims-made basis, with individual limits running from INR 10 lakh to several crore for high-risk specialists. Claims-made cover responds only to claims first made during the policy period, subject to a retroactive date, so a doctor whose retroactive date does not reach back to the consultation in question, or who let cover lapse, has a hole no later policy will fill. A platform leaning on doctor-held cover should contractually demand a minimum limit, a retroactive date reaching back across the empanelment, proof of unbroken cover, and either an additional-interest noting or a subrogation waiver in the platform's favour.
The panel policy is the layer most platforms underbuild. Instead of trusting dozens of individual policies of uneven quality, the platform arranges one policy over the empanelled pool that responds to clinical claims from platform consultations whoever the treating doctor was. This gives the company control of limits, retroactive dates and claims handling it can never get from scattered individual cover. For a platform running several lakh consultations a year, a panel programme with a per-claim limit around INR 5 to 15 crore and an aggregate of INR 25 to 75 crore is realistic, priced off consultation volume, specialty mix and loss history.
Specialty mix drives the price more than anything else, because severity is wildly uneven across clinical areas. A consultation in general medicine, dermatology or nutrition sits nowhere near a consultation touching cardiology, oncology, psychiatry, obstetrics, paediatric emergencies or any urgent-care triage. The catastrophic claims cluster around one failure: not escalating a real emergency. A missed myocardial infarction, an undetected sepsis, an ectopic pregnancy managed remotely instead of being sent to in-person emergency care. Underwriters dig into red-flag escalation logic and the precise boundary of conditions a doctor may handle on the platform at all.
The guidelines themselves shape both liability and cover. They restrict or prohibit certain medicine categories in a first teleconsultation absent prior in-person examination, require the practitioner to judge whether remote care is appropriate, and mandate consent and record-keeping. A prescription issued against these rules is a regulatory breach and a ready-made negligence allegation if harm follows. The defensible move is to encode the constraints into the prescribing workflow so the system itself blocks a non-compliant script, which both reduces harm and signals active risk management to underwriters.
The wrap, whether attached to the panel policy or written as a separate healthcare-establishment liability cover, answers claims aimed at the company entity: vicarious liability, negligent empanelment, and allegations that the platform's own processes contributed to harm. Making the three layers respond as one, on a shared retroactive date, without gaps and without double recovery, is the real craft in a healthtech clinical programme, and it lives entirely in wording detail.
When the Code, Not the Clinician, Is in the Dock
Clinical indemnity answers for the doctor's judgment. It does nothing for the case where the platform's own software is alleged to have caused the harm. That belongs to technology professional indemnity (technology errors and omissions), and for a software-first health company it carries as much weight as the clinical cover.
The relevant failure modes are concrete and grow sharper as platforms automate. A triage or symptom-checker that grades an urgent presentation as routine and never escalates. A prescription-routing engine that pushes the wrong drug or dose to the e-pharmacy fulfilment layer. A record that surfaces the wrong patient's history to a doctor mid-call. A scheduling or availability failure that blocks a deteriorating patient from reaching anyone. An interaction checker that misses a contraindication. None of these is a clinical act, and none can be handed off to an empanelled doctor.
The boundary between the two covers is where claims are won and lost, and it is almost never clean. A patient hurt by a missed escalation will plead both that the doctor erred and that the triage logic was defective, dragging both policies onto risk. Each insurer points at the other while the platform pays the running defence cost. The single most valuable thing a healthtech buyer can secure is alignment between the clinical and technology programmes: the same insurer group where possible, shared retroactive dates, joined-up claims handling, and wording read line against line so a triage-failure claim cannot drop through a gap between a medical-services exclusion in the tech policy and a software-failure exclusion in the clinical policy.
Clinical AI raises the stakes again. Platforms now run machine-learning models for triage, dermatology and retinal image analysis, risk scoring and conversational intake. Where a model shapes or replaces clinical judgment, the liability multiplies. If an image classifier returns benign for a lesion that was melanoma and the doctor relied on it, the platform faces a technology PI exposure for the model error sitting on top of any clinical exposure for the reliance. Most technology E&O forms were written for conventional software and are silent or unhelpful on algorithmic clinical decisions.
The trap is the bodily-injury exclusion that many standard technology E&O forms carry. A clinical AI failure that causes physical harm is exactly the bodily-injury scenario such an exclusion strips out, leaving the platform uninsured at its single most consequential point. Buyers deploying clinical AI must either buy back the carve-out or write the clinical programme to catch what the tech policy drops.
Placement for an Indian healthtech runs through ICICI Lombard, HDFC Ergo, TATA AIG or Bajaj Allianz with reinsurance support, or into international markets for larger limits, typically INR 10 to 50 crore for early and growth stage and higher as enterprise contracts impose minimums. Hospital groups, insurers buying teleconsultation as a benefit and government health programmes routinely make technology PI and clinical indemnity at stated limits, plus additional-insured status, a precondition of the deal, so the cover is a commercial gate as much as a risk choice. Two further heads deserve scrutiny for B2B-heavy platforms: a patent-infringement allegation against the software, and a breach of an enterprise service-level agreement, both of which may sit inside the technology PI wording depending on how it is drafted.
Health Records, the DPDP Act and the Cyber Response
A teleconsultation platform holds the most sensitive category of personal data there is, at scale: patient identities, payment details, diagnoses, prescriptions, lab results, mental-health notes, reproductive-health histories. On a probability-weighted view of severity, no other exposure in this article matches a breach of this data.
The frame is the Digital Personal Data Protection Act, 2023. The platform is a data fiduciary for its patients, which carries duties to obtain valid consent, process only for specified lawful purposes, keep reasonable security safeguards, notify the Data Protection Board and affected patients of a breach, and honour rights of access, correction and erasure. The penalty schedule contemplates up to INR 250 crore for failing to maintain reasonable security safeguards against a breach. That figure moves a breach from an IT incident to a board-level financial event.
The Act does not carve out health data into a separate sensitive tier the way the EU GDPR does, but health data draws the fiercest enforcement attention, the angriest patients and the deepest reputational damage in practice. A breach exposing mental-health or reproductive-health records inflicts harm far beyond any statutory penalty. The notification duty also imposes a defined operational burden on regulatory timelines: detect, scope, notify the Board and the individuals, and document the whole response.
Cyber insurance is the cover that answers this, and for a health platform it is not discretionary. First-party cover meets the platform's own losses: forensic and incident-response cost, the legal cost of notifying and engaging the Data Protection Board, data restoration, business interruption from an outage, and ransomware response handled carefully around sanctions and the legality of any payment. Third-party cover answers patients and enterprise customers whose data the platform held, including defence and damages on privacy claims. The decisive wording point is the penalty. Insurers will fund the cost of defending a regulatory investigation, but the insurability of the DPDP penalty itself is constrained, because Indian public policy generally resists insuring penalties imposed for the insured's own statutory breach. Founders should pin down what the policy actually pays (investigation and defence cost almost always, the penalty rarely or never) rather than assume the headline number is insured away.
The underwriting questions are health-specific and demanding. Insurers test encryption of records at rest and in transit, least-privilege access for clinical staff, multi-factor authentication, separation of the consultation environment from the e-pharmacy and payment systems, vendor risk across cloud, video, lab and analytics partners that all touch patient data, retention and deletion aligned to DPDP minimisation, and the breach-response plan itself. A platform that cannot evidence these controls meets higher premiums, lower limits, sub-limits on the heads that matter, or declinature.
One incident routinely lights up several policies at once. A breach of clinical records caused by a software vulnerability can engage cyber (the breach and notification), technology PI (the underlying code error) and the clinical and platform programme (if patients allege the breach caused clinical harm or distress). Mapping those overlaps before an incident is the difference between a coordinated response and a multi-insurer argument over who answers first.
E-Pharmacy, Regulators and the Founder-Level Exposures
Beyond clinical, software and data risk sits a band of management and entity-level exposure that founders discount until an investor demand or a claim forces it into view. Directors and officers liability (D&O) leads this band, and healthtech sharpens it because more regulators hold jurisdiction here than over almost any other startup sector.
D&O answers claims against the company's directors and officers for wrongful acts in their managerial role, and against the entity itself in defined situations. The live sources in healthtech are several. Investors who funded the company on clinical-outcome data, compliance representations or growth projections may allege misrepresentation when performance slips or a regulatory problem surfaces. Employees may bring wrongful-termination, discrimination or harassment claims. Commercial counterparties may sue on disputes. The Companies Act, 2013, including the section 166 duties and the section 447 fraud provisions, exposes directors to personal liability that, absent D&O, their own assets must satisfy.
What marks healthtech out is the density of regulators that can investigate the company and its officers: the National Medical Commission on telemedicine conduct, the Central Drugs Standard Control Organisation on e-pharmacy and prescription compliance, the Data Protection Board on data handling, and the Central Consumer Protection Authority on advertising and consumer claims. For a venture-funded healthtech, D&O is usually a term of the round, partly to shield the investor-nominated directors on the board. A typical early-to-growth programme sits between INR 15 and 50 crore, priced off funding raised, the sector's elevated regulatory loading, loss history and governance maturity, and it should carry entity cover for securities-type claims, regulatory investigation-cost cover, and either embedded or coordinated employment-practices cover.
The e-pharmacy component deserves its own paragraph because it widens the regulatory surface materially. Where the platform fulfils prescriptions, it sits inside the Drugs and Cosmetics Act framework and the still-evolving treatment of online pharmacy, which has churned through repeated draft rules and enforcement attention. Such a platform carries compliance exposure on prescription validity, the sale of restricted drugs, and the integrity of the consultation-to-prescription-to-dispensing chain. D&O regulatory cover funds the defence of officers in these investigations; it does not bless non-compliant practice, and underwriters scope and price it by how cleanly the platform runs that chain.
Employment-practices and statutory employee cover complete the band. The platform's own engineering, product, clinical-operations and support staff generate the standard employer exposures: claims under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013; wrongful-termination and discrimination claims; and the statutory duty under the Employees' Compensation Act, 1923 alongside group personal accident and group health cover. These scale with a fast-hiring headcount, and the cover should scale with them.
A distinct exposure for clinically active platforms is healthcare advertising. The Central Consumer Protection Authority polices misleading advertisements, and the Advertising Standards Council of India code is unusually strict on claims of cure, efficacy and outcome. The Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954 adds a further bar on advertising treatments for specified conditions. A platform that advertises clinical outcomes, doctor qualifications or efficacy it cannot substantiate faces regulatory penalty and consumer claims that loop back into both the D&O and the wider liability programme. A disciplined claims-substantiation process is, in underwriting terms, a materially better risk.
Continuity, Contracts and Reading Wordings Against Each Other
A founder who has followed the argument will see that the need is not a policy but a coordinated programme: clinical indemnity at doctor, panel and platform levels, technology professional indemnity, cyber, and directors and officers, with employment and statutory cover beneath. The value is not in owning each line. It is in making the lines respond together, because real healthtech claims ignore the tidy borders between policies.
Contracts come first because they decide who carries what. The empanelment agreement should fix the doctor's independent-contractor status, demand clinical indemnity at a stated minimum limit with an adequate retroactive date, run an indemnity from doctor to platform for clinical negligence, and secure a subrogation waiver where the panel policy responds. The enterprise agreements run the requirement the other way: hospitals, insurers, employers and government programmes impose insurance limits, certificates and additional-insured status that the platform must actually hold. A mismatch between what those contracts demand and what the company carries surfaces, awkwardly, during a procurement audit or after a claim.
Coordination between the lines is where wording decides the outcome. Clinical indemnity and technology PI should share retroactive dates and, ideally, claims-handling alignment, so a triage-failure claim that engages both does not fall into a coverage gap. Cyber and technology PI should be read together so a software vulnerability that causes a data breach is not disowned by both as belonging to the other. D&O should be checked against the professional-liability lines so a regulatory investigation flowing from a clinical or data incident has a clear home. None of this shows on a schedule of limits; it lives in the exclusions, definitions, triggers and sub-limits buried in each wording.
The claims-made nature of nearly every line forces a continuity discipline founders must internalise. Clinical indemnity, technology PI, cyber and D&O each answer only claims first made during their period, subject to the retroactive date. A lapse, an insurer change that resets the retroactive date, or a failure to buy extended-reporting run-off on a non-renewed policy can open a gap that swallows a claim from an earlier consultation or incident. This bites hardest in healthtech because a clinical claim can surface years after the consultation, well outside the period in which it occurred, so financing events, acquisitions and insurer changes all demand active retroactive-date and run-off management.
Presenting the risk well is itself a risk-financing move. A platform that can evidence its clinical protocols and escalation logic, its specialty boundaries, its prescribing controls aligned to the guidelines, its DPDP-aligned data posture, its consent and record-keeping, and its advertising governance is not merely cheaper to insure; it is more insurable, because insurers ration clinical capacity and a poorly controlled platform may fail to secure adequate limits at any price.
The hard part for a broker and a founder is comparing what each insurer's wording actually does across these overlapping lines: which triggers apply, which grants exist, which sub-limits cap the key heads, and which exclusions could defeat the precise healthtech failure mode, whether a clinical AI error, a dependent-outage, a penalty-insurability question or a bodily-injury carve-out in the tech policy. Sarvada lets commercial insurance brokers search and compare insurer policy wordings, setting clinical indemnity, technology PI, cyber and D&O triggers, grants, sub-limits and exclusions side by side so the gap is found on paper rather than in a claim. Brokers placing teleconsultation programmes can Request Access to put this wording-comparison to work on a live healthtech submission.